You are implementing communications restrictions for specific services in your Google Cloud organization. Your data analytics team works in a dedicated folder. You need to ensure that access to…

Question

Options

• ACreate an organization-level access policy with a service perimeter to restrict BigQuery access.
• BCreate a scoped policy on the folder with a service perimeter to restrict BigQuery access. Assign
• CDefine a hierarchical firewall policy on the folder to deny BigQuery access. Assign the data
• DEnforce the Restrict Resource Service Usage organization policy constraint on the folder to

• A
  7% (2)
• B
  74% (20)
• C
  4% (1)
• D
  15% (4)

Explanation

Option B is correct because VPC Service Controls supports scoped access policies, which can be tied to a specific folder rather than the entire organization. A scoped policy grants the data analytics team the ability to create and manage service perimeters (including BigQuery restrictions) autonomously at their folder level - exactly matching the requirement for folder-level control.

Why the distractors are wrong:

• A is wrong because an org-level access policy requires org-level admin privileges to manage; the data analytics team cannot control it independently at the folder level.
• C is wrong because hierarchical firewall policies operate at the network layer (L3/L4) and control VM-to-VM traffic - they cannot restrict access to Google APIs like BigQuery.
• D is wrong because the restrictServiceUsage org policy constraint prevents service resource creation, but doesn't create security perimeters or provide the communications-restriction control that VPC Service Controls offers.

Memory tip: Think "Scoped = Delegated folder control." Whenever an exam question requires a team to self-manage service restrictions within their folder (not the whole org), the answer involves a scoped access policy under VPC Service Controls - scope delegates ownership down the hierarchy.

No community discussion yet for this question.