You have a highly sensitive BigQuery workload that contains personally identifiable information (PII) that you want to ensure is not accessible from the internet. To prevent data exfiltration, only…

Question

Options

• AUse service perimeter and create an access level based on the authorized source IP address as
• BUse Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the
• CUse the Restrict Resource Service Usage organization policy constraint along with Cloud Data
• DUse the Restrict allowed Google Cloud APIs and services organization policy constraint along

• A
  75% (15)
• B
  5% (1)
• C
  15% (3)
• D
  5% (1)

Explanation

VPC Service Controls allow you to build a security perimeter around GCP resources like BigQuery. Access levels within that perimeter can enforce IP-based conditions, meaning only requests originating from authorized IP ranges can reach the BigQuery APIs - even if valid credentials are used from an unauthorized network. This prevents both unauthorized access and data exfiltration. Option B (Google Cloud Armor) protects HTTP load balancer endpoints and cannot restrict direct BigQuery API calls. Options C and D (organization policy constraints) govern which services or APIs can be used within an org, but do not enforce IP-based access restrictions at the API level for specific datasets.

No community discussion yet for this question.