hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A healthcare company uses GCP to store sensitive…
A healthcare company uses GCP to store sensitive patient data in Cloud Storage buckets. Their security policy requires that all data access be logged and that any attempt to access data from outside the corporate network is blocked. They have implemented VPC Service Controls to create a service perimeter around the projects containing the buckets. They have also enabled Data Access audit logs. However, during an audit, they find that a few access attempts from an IP address outside the corporate network succeeded. The logs show that the requests were made using service account credentials. The service account has the storage.objectViewer role on the bucket. The VPC Service Controls perimeter is configured to block all access from outside the perimeter, but the logs show that some requests were allowed. What is the most likely reason?
⚠ Common exam trap
Google Cloud often tests the misconception that VPC Service Controls blocks all traffic from outside the perimeter unconditionally, but the trap here is that access levels can create exceptions that allow specific IP ranges, including non-corporate IPs, to bypass the block.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC Service Controls perimeter was configured with an access level that permits certain IP ranges.
VPC Service Controls can be configured with access levels that define allowed client IP ranges. If the access level permits the IP addresses from which the service account requests originated, those requests would be allowed even though they come from outside the corporate network. The logs confirm that the requests used service account credentials, and the storage.objectViewer role grants read access, so the only remaining control that could have been bypassed is the VPC Service Controls perimeter — and an overly permissive access level is the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VPC Service Controls perimeter was configured with an access level that permits certain IP ranges.
Why this is correct
VPC Service Controls access levels allow you to define context-based conditions, such as allowed IP ranges, under which requests are permitted. If the requester's external IP address falls within a range listed in the access level, the perimeter will not block the request even though it originates outside the VPC network. Thus, the configuration of an IP-based access level explains why the sensitive data was accessible.
- ✗
The bucket is outside the service perimeter.
Why it's wrong here
The explanation states the perimeter is configured around the projects that contain the bucket, so the bucket is inside the perimeter by definition. If the bucket were outside, VPC SC would not be protecting it, but that would be a different misconfiguration, not the reason access succeeded given the premise. Therefore, saying the bucket is outside contradicts the scenario and doesn't explain why the access level allowed the request.
- ✗
The service account is a member of the perimeter.
Why it's wrong here
Being listed as a member of a perimeter does not exempt a service account from VPC SC enforcement. VPC SC evaluates the request context — including the source IP and whether the API call crosses a perimeter boundary — not the identity's membership. A service account's identity is governed by IAM permissions, but VPC SC acts as a security boundary that blocks requests from outside regardless of who makes them.
- ✗
The VPC Service Controls perimeter does not block requests made by service accounts.
Why it's wrong here
VPC Service Controls is not an identity-based access control system; it applies uniformly to all principals, including service accounts. The premise that service accounts are exempt misunderstands VPC SC's design: it enforces context-aware boundaries at the API layer, so even a service account with valid IAM roles cannot access resources from outside the perimeter unless an access level allows it. Therefore this statement is false and does not explain the access.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.