Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access on

Question

Options

• ACreate an access context policy that allows your VPC and corporate public network IP ranges,
• BCreate a VPC Service Controls perimeter for your project with an access context policy that
• CCreate a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized
• DCreate a VPC Service Controls perimeter for each VPC with an access context policy that allows

• A
  6% (3)
• B
  79% (37)
• C
  4% (2)
• D
  11% (5)

Explanation

VPC Service Controls creates a security perimeter around GCP resources (like Cloud Storage buckets and BigQuery datasets) to prevent data exfiltration and unauthorized access. Access Context Manager policies can enforce conditions such as allowed IP ranges (both VPC internal ranges and corporate public IPs). A single perimeter around the entire project is appropriate since all VPCs are in one project. Option A describes creating an access policy without a VPC Service Controls perimeter - without the perimeter, the policy alone cannot restrict Google API access. Option C is wrong because VPC firewall rules control VM-to-VM traffic and cannot restrict access to Google managed service APIs. Option D suggests creating separate perimeters for each VPC, which is overly complex, unnecessary for a single project, and could create unintended restrictions between resources in the same project.

No community discussion yet for this question.