You manage one of your organization's Google Cloud projects (Project A). A VPC Service Control (SC) perimeter is blocking API access requests to this project, including Pub/Sub. A resource running…

Question

Options

• AConfigure an ingress policy for the perimeter in Project A, and allow access for the service
• BCreate an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that
• CCreate a perimeter bridge between Project A and Project B to allow the required communication
• DRemove the Pub/Sub API from the list of restricted services in the perimeter configuration for

• A
  59% (17)
• B
  24% (7)
• C
  10% (3)
• D
  7% (2)

Explanation

VPC Service Controls ingress policies are the correct mechanism for allowing a specific external resource (outside the perimeter) to access a protected resource inside the perimeter without adding the entire external project to the perimeter. Option A configures an ingress rule on Project A's perimeter that permits the specific service account from Project B to call the Pub/Sub API in Project A - following least privilege because only that service account and only the Pub/Sub API are permitted. Option B (access level based on developer identity) grants access based on a human user's attributes, not a service account, and is not suitable for automated resource-to-resource communication. Option C (perimeter bridge) connects two perimeters but Project B has no perimeter, so a bridge cannot be formed. Option D (removing Pub/Sub from restricted services) would disable VPC SC protection for Pub/Sub across the entire perimeter, violating least privilege and weakening security for all other resources.

No community discussion yet for this question.