VPC Service Controls in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding VPC Service Controls Perimeter Behavior

You have created a VPC Service Controls perimeter around your Google Cloud project to protect sensitive data. Which of the following statements best describes what happens when a request originates from outside the perimeter trying to access a protected service inside?

A The request is blocked unless it originates from a resource inside the perimeter or from an authorized access level.

B The request is always allowed but logged for auditing purposes.

C The request is allowed if it uses a service account with the correct IAM role, regardless of origin.

D The request is allowed only if it comes from a trusted IP address range configured in the perimeter.

💡 Hint

Think about how VPC Service Controls restrict access based on network boundaries and access levels.

VPC Service Controls create a security perimeter that blocks access to protected services from outside unless the request originates from inside the perimeter or meets specific access level conditions.

❓ Architecture

intermediate

Designing a VPC Service Controls Perimeter for Multi-Project Access

You have two Google Cloud projects: Project A and Project B. Both need to access a shared Cloud Storage bucket protected by a VPC Service Controls perimeter. How should you configure the perimeter to allow access from both projects?

A Create a single perimeter that includes both Project A and Project B as protected resources.

B Do not use perimeters; rely solely on IAM permissions for access control.

C Create a perimeter only around Project A and grant IAM roles to Project B's service accounts.

D Create separate perimeters for each project and link them with a service perimeter bridge.

💡 Hint

Consider how VPC Service Controls handle multiple projects needing shared access.

Using a service perimeter bridge allows multiple perimeters to communicate securely, enabling access across projects within the protected boundary.

❓ security

advanced

Evaluating Access Levels in VPC Service Controls

You configured an access level using Access Context Manager to allow access only from devices with a specific security posture. Which of the following is a valid way to enforce this access level in your VPC Service Controls perimeter?

A Use the access level only in IAM policies for service accounts accessing resources.

B Attach the access level to the perimeter's ingress rules to restrict incoming requests.

C Apply the access level as an egress rule to control outbound traffic from the perimeter.

D Configure the access level as a firewall rule in the VPC network.

💡 Hint

Think about how access levels integrate with VPC Service Controls to restrict access.

Access levels are used in ingress rules of VPC Service Controls perimeters to restrict which requests can enter the perimeter based on device or user attributes.

❓ service_behavior

advanced

Impact of VPC Service Controls on Cloud Functions Invocations

You have deployed Cloud Functions inside a VPC Service Controls perimeter. What happens when an external client tries to invoke a Cloud Function protected by the perimeter without proper access level?

A The invocation is queued until the client gains proper access level.

B The Cloud Function executes but logs a warning about perimeter violation.

C The invocation request is blocked and returns a 403 Forbidden error.

D The Cloud Function executes normally because VPC Service Controls do not affect Cloud Functions.

💡 Hint

Consider how VPC Service Controls enforce perimeter boundaries on service invocations.

Requests from outside the perimeter without proper access are blocked, resulting in a 403 error to prevent unauthorized access.

✅ Best Practice

expert

Optimizing VPC Service Controls Perimeter for Least Privilege Access

You want to enforce least privilege access using VPC Service Controls for a sensitive BigQuery dataset. Which configuration best achieves this goal?

A Create a perimeter including only the BigQuery service and restrict access with access levels based on user identity and device security.

B Create a perimeter including all Google Cloud services and allow access from all internal IP ranges.

C Use IAM roles only without creating a perimeter to simplify management.

D Create a perimeter including BigQuery and Cloud Storage, allowing access from any Google-managed service account.

💡 Hint

Think about how to limit access to only what is necessary and secure.

Including only the necessary service and enforcing access levels based on identity and device security ensures least privilege and reduces attack surface.