VPC Service Controls in GCP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of VPC Service Controls in Google Cloud?

VPC Service Controls help protect sensitive data by creating a security perimeter around Google Cloud services to prevent data exfiltration.

beginner

How does VPC Service Controls restrict access to Google Cloud services?

It restricts access by defining service perimeters that limit which resources and users can communicate with protected services based on network boundaries.

intermediate

What is a service perimeter in VPC Service Controls?

A service perimeter is a virtual boundary that defines which Google Cloud resources are protected and controls data communication across that boundary.

intermediate

Can VPC Service Controls protect data from being accessed by users outside the perimeter even if they have valid credentials?

Yes, VPC Service Controls enforce access restrictions based on network location, so even valid credentials cannot access data outside the perimeter.

beginner

Name two Google Cloud services commonly protected by VPC Service Controls.

BigQuery and Cloud Storage are commonly protected services to prevent data exfiltration.

What does a VPC Service Controls perimeter primarily protect against?

A Billing fraud

B Unauthorized VM creation

C Data exfiltration from Google Cloud services

D Network latency issues

VPC Service Controls create a security boundary to prevent data exfiltration from protected services.

Which of the following is true about VPC Service Controls?

A They manage DNS settings

B They replace IAM roles

C They encrypt data at rest

D They restrict access based on network boundaries

VPC Service Controls restrict access by defining network-based service perimeters.

If a user has valid credentials but is outside the service perimeter, can they access protected data?

A Only during business hours

B No, access is blocked by the perimeter

C Yes, credentials override perimeter

D Only if using VPN

VPC Service Controls block access based on network location even if credentials are valid.

Which Google Cloud service is NOT typically protected by VPC Service Controls?

A Cloud DNS

B BigQuery

C Cloud Functions

D Cloud Storage

Cloud DNS is not typically protected by VPC Service Controls as it is a global service outside the perimeter scope.

What is required to create a service perimeter in VPC Service Controls?

A Select Google Cloud projects and services to protect

B Create firewall rules

C Enable Cloud Armor

D Configure IAM policies only

Service perimeters are created by selecting projects and services to include within the protected boundary.

Explain how VPC Service Controls help protect sensitive data in Google Cloud.

Think about how a fence protects a garden by keeping things inside safe.

Describe what a service perimeter is and how it works in VPC Service Controls.

Imagine a fence around a playground that only lets certain people in.