Your organization has two Google Cloud projects, project A and project B. In project A, you have a Pub/Sub topic that receives data from confidential sources. Only the resources in project A should…

Question

Options

• AAdd firewall rules in project A so only traffic from the VPC in project A is permitted.
• BConfigure VPC Service Controls in the organization with a perimeter around project A.
• CUse Identity and Access Management conditions to ensure that only users and service accounts in project A. can access resources in project A.
• DConfigure VPC Service Controls in the organization with a perimeter around the VPC of project A.

• A
  16% (8)
• B
  71% (36)
• C
  4% (2)
• D
  10% (5)

Explanation

VPC Service Controls creates a security perimeter around Google Cloud services (like Pub/Sub, BigQuery, Cloud Storage) at the project level, preventing data exfiltration across project boundaries - making B the right tool for isolating project A's Pub/Sub topic from all other projects, including future ones.

Why the distractors fail:

• A - Firewall rules control network traffic between VMs/VPCs, but Pub/Sub is a managed service accessed via APIs, not network paths; firewalls don't apply here.
• C - IAM controls who can access resources, but it requires manually updating policies for every new project; it doesn't provide an automatic blanket restriction against future projects.
• D - VPC Service Controls perimeters are placed around projects, not VPCs. There is no concept of wrapping a perimeter around a VPC itself.

Memory tip: Think of VPC Service Controls as a "project bubble" - it seals the API boundary of an entire project, while IAM is the "guest list" (manual, per-identity). When the question says "any future project," that's your signal that you need an automatic boundary (Service Controls), not a manual list (IAM).

No community discussion yet for this question.