VPC Service Controls in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding VPC Service Controls Perimeter Behavior

You have created a VPC Service Controls perimeter around your Google Cloud project to protect sensitive data. Which of the following statements best describes what happens when a request originates from outside the perimeter trying to access a protected service inside?

A The request is blocked unless it originates from a resource inside the perimeter or from an authorized access level.

B The request is always allowed but logged for auditing purposes.

C The request is allowed if it uses a service account with the correct IAM role, regardless of origin.

D The request is allowed only if it comes from a trusted IP address range configured in the perimeter.

💡 Hint

Think about how VPC Service Controls restrict access based on network boundaries and access levels.

VPC Service Controls create a security perimeter that blocks access to protected services from outside unless the request originates from inside the perimeter or meets specific access level conditions.

❓ Architecture

intermediate

Designing a VPC Service Controls Perimeter for Multi-Project Access

You have two Google Cloud projects: Project A and Project B. Both need to access a shared Cloud Storage bucket protected by a VPC Service Controls perimeter. How should you configure the perimeter to allow access from both projects?

A Create a single perimeter that includes both Project A and Project B as protected resources.

B Do not use perimeters; rely solely on IAM permissions for access control.

C Create a perimeter only around Project A and grant IAM roles to Project B's service accounts.

D Create separate perimeters for each project and link them with a service perimeter bridge.

💡 Hint

Consider how VPC Service Controls handle multiple projects needing shared access.

Using a service perimeter bridge allows multiple perimeters to communicate securely, enabling access across projects within the protected boundary.

❓ security

advanced

Evaluating Access Levels in VPC Service Controls

You configured an access level using Access Context Manager to allow access only from devices with a specific security posture. Which of the following is a valid way to enforce this access level in your VPC Service Controls perimeter?

A Use the access level only in IAM policies for service accounts accessing resources.

B Attach the access level to the perimeter's ingress rules to restrict incoming requests.

C Apply the access level as an egress rule to control outbound traffic from the perimeter.

D Configure the access level as a firewall rule in the VPC network.

💡 Hint

Think about how access levels integrate with VPC Service Controls to restrict access.

Access levels are used in ingress rules of VPC Service Controls perimeters to restrict which requests can enter the perimeter based on device or user attributes.

❓ service_behavior

advanced

Impact of VPC Service Controls on Cloud Functions Invocations

You have deployed Cloud Functions inside a VPC Service Controls perimeter. What happens when an external client tries to invoke a Cloud Function protected by the perimeter without proper access level?

A The invocation is queued until the client gains proper access level.

B The Cloud Function executes but logs a warning about perimeter violation.

C The invocation request is blocked and returns a 403 Forbidden error.

D The Cloud Function executes normally because VPC Service Controls do not affect Cloud Functions.

💡 Hint

Consider how VPC Service Controls enforce perimeter boundaries on service invocations.

Requests from outside the perimeter without proper access are blocked, resulting in a 403 error to prevent unauthorized access.

✅ Best Practice

expert

Optimizing VPC Service Controls Perimeter for Least Privilege Access

You want to enforce least privilege access using VPC Service Controls for a sensitive BigQuery dataset. Which configuration best achieves this goal?

A Create a perimeter including only the BigQuery service and restrict access with access levels based on user identity and device security.

B Create a perimeter including all Google Cloud services and allow access from all internal IP ranges.

C Use IAM roles only without creating a perimeter to simplify management.

D Create a perimeter including BigQuery and Cloud Storage, allowing access from any Google-managed service account.

💡 Hint

Think about how to limit access to only what is necessary and secure.

Including only the necessary service and enforcing access levels based on identity and device security ensures least privilege and reduces attack surface.

Practice

1. What is the main purpose of VPC Service Controls in Google Cloud?

easy

A. To manage user identities and access permissions

B. To create a secure boundary around cloud services to protect data

C. To automatically back up data to multiple regions

D. To increase the speed of network traffic between services

Solution

1. Step 1: Understand the role of VPC Service Controls

   VPC Service Controls create a security perimeter around Google Cloud services to protect sensitive data from unauthorized access.

2. Step 2: Compare with other options

   Options A, B, and C describe different Google Cloud features unrelated to VPC Service Controls.

3. Final Answer:

   To create a secure boundary around cloud services to protect data -> Option B

4. Quick Check:

   VPC Service Controls = Secure boundary [OK]

Hint: VPC Service Controls protect data by creating security boundaries [OK]

Common Mistakes:

• Confusing VPC Service Controls with identity management
• Thinking it speeds up network traffic
• Assuming it handles backups automatically

2. Which of the following is the correct way to define a VPC Service Controls perimeter in a YAML configuration?

easy

A. perimeterType: 'NETWORK_PERIMETER'
resources:
- projects/project-123
restrictedServices:
- storage.googleapis.com
enforce: true

B. perimeterType: 'SERVICE_PERIMETER'
resources:
- projects/project-123
restrictedServices:
- storage.googleapis.com
allowAll: true

C. perimeterType: 'SERVICE_PERIMETER'
resources:
- projects/project-123
restrictedServices:
- compute.googleapis.com
enforce: false

D. perimeterType: 'SERVICE_PERIMETER'
resources:
- projects/project-123
restrictedServices:
- storage.googleapis.com
enforce: true

Solution

1. Step 1: Identify correct perimeter type and enforcement

   VPC Service Controls use 'SERVICE_PERIMETER' as perimeterType and enforce true to activate restrictions.

2. Step 2: Check restricted services and resource format

   Restricted services should list Google Cloud APIs like storage.googleapis.com, and resources should be project IDs.

3. Final Answer:

   perimeterType: 'SERVICE_PERIMETER' with enforce: true and correct resources -> Option D

4. Quick Check:

   Correct perimeterType and enforce true = perimeterType: 'SERVICE_PERIMETER' resources: - projects/project-123 restrictedServices: - storage.googleapis.com enforce: true [OK]

Hint: SERVICE_PERIMETER with enforce: true is required for VPC SC [OK]

Common Mistakes:

• Using NETWORK_PERIMETER instead of SERVICE_PERIMETER
• Setting enforce to false disables the perimeter
• Using allowAll instead of enforce

3. Given this VPC Service Controls perimeter configuration:

perimeterType: 'SERVICE_PERIMETER'
resources:
  - projects/project-abc
restrictedServices:
  - storage.googleapis.com
  - bigquery.googleapis.com
enforce: true

What happens if a VM in project-abc tries to access compute.googleapis.com?

medium

A. Access is allowed only if the VM has special IAM roles

B. Access is denied because all services are blocked inside the perimeter

C. Access is allowed because compute.googleapis.com is not restricted

D. Access is denied because compute.googleapis.com is implicitly restricted

Solution

1. Step 1: Understand restricted services in the perimeter

   The perimeter restricts only storage.googleapis.com and bigquery.googleapis.com.

2. Step 2: Check access to compute.googleapis.com

   Since compute.googleapis.com is not listed, access is allowed by default.

3. Final Answer:

   Access is allowed because compute.googleapis.com is not restricted -> Option C

4. Quick Check:

   Only listed services are restricted = Access is allowed because compute.googleapis.com is not restricted [OK]

Hint: Only services listed in restrictedServices are blocked [OK]

Common Mistakes:

• Assuming all services are blocked inside perimeter
• Thinking IAM roles override perimeter restrictions
• Believing unlisted services are implicitly blocked

4. You configured a VPC Service Controls perimeter but users report they cannot access Cloud Storage from inside the perimeter. Which of the following is the most likely cause?

medium

A. The perimeter's restrictedServices includes storage.googleapis.com and enforce is set to true

B. The perimeter is missing storage.googleapis.com in restrictedServices

C. The perimeter's enforce is set to false

D. The perimeter uses NETWORK_PERIMETER instead of SERVICE_PERIMETER

Solution

1. Step 1: Analyze the effect of restrictedServices and enforce

   If storage.googleapis.com is in restrictedServices and enforce is true, access to Cloud Storage is blocked inside the perimeter.

2. Step 2: Evaluate other options

   Missing storage.googleapis.com or enforce false would allow access; NETWORK_PERIMETER is invalid for VPC SC.

3. Final Answer:

   restrictedServices includes storage.googleapis.com and enforce is true -> Option A

4. Quick Check:

   Restricted service + enforce true blocks access [OK]

Hint: Restricted service with enforce true blocks access inside perimeter [OK]

Common Mistakes:

• Thinking missing restrictedServices blocks access
• Assuming enforce false blocks access
• Confusing NETWORK_PERIMETER with SERVICE_PERIMETER

5. Your company wants to protect sensitive data in BigQuery and Cloud Storage using VPC Service Controls. You have two projects: project-secure and project-public. You want to allow project-public to access BigQuery but not Cloud Storage inside the perimeter. How should you configure the perimeter?

hard

A. Include both projects in resources, restrict only storage.googleapis.com

B. Include only project-secure in resources, restrict both storage.googleapis.com and bigquery.googleapis.com

C. Include both projects in resources, restrict both storage.googleapis.com and bigquery.googleapis.com

D. Include only project-public in resources, restrict storage.googleapis.com

Solution

1. Step 1: Determine which projects to include in the perimeter

   To protect data in both projects but allow project-public access to BigQuery, include both projects in the perimeter.

2. Step 2: Set restricted services to block only Cloud Storage

   Restrict storage.googleapis.com to block Cloud Storage access, but do not restrict bigquery.googleapis.com to allow BigQuery access from project-public.

3. Final Answer:

   Include both projects and restrict only storage.googleapis.com -> Option A

4. Quick Check:

   Both projects + restrict storage only = Include both projects in resources, restrict only storage.googleapis.com [OK]

Hint: Restrict only storage to block Cloud Storage, include both projects [OK]

Common Mistakes:

• Restricting both services blocks BigQuery access
• Including only one project limits protection
• Restricting BigQuery when access is needed