hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A security team wants to prevent authorized users…
A security team wants to prevent authorized users from copying BigQuery query results to a dataset in a different GCP project that is outside the team's security boundary — even if the user has valid IAM permissions. Which control enforces this?
⚠ Common exam trap
Watch out — candidates often assume IAM deny policies can block data movement across projects, but VPC Service Controls are the only mechanism that enforces data exfiltration boundaries at the network layer, overriding IAM permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls with a perimeter enclosing BigQuery
VPC Service Controls (VPC-SC) create a security perimeter around Google Cloud services, including BigQuery, that prevents data exfiltration to projects outside the perimeter regardless of IAM permissions. By configuring a service perimeter that includes BigQuery and the authorized project, any attempt to copy query results to a dataset in a project outside the perimeter is blocked, even if the user has valid IAM roles. This enforces a data boundary that overrides IAM-based access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM deny policies restricting cross-project BigQuery operations
Why it's wrong here
IAM deny policies are evaluated at the IAM permission level and can block specific actions like bigquery.tables.getData or bigquery.jobs.create, but they are not context-aware and do not restrict the destination of an operation. If the user already holds the necessary BigQuery roles in the target project, an IAM deny policy cannot prevent them from issuing a cross-project query or export that copies data there. Deny policies only say who can or cannot call an API, not where the data can ultimately land, so they fail to create a boundary that stops authorized users from exfiltrating data across projects.
- ✓
VPC Service Controls with a perimeter enclosing BigQuery
Why this is correct
VPC Service Controls is the only option that enforces context-aware access at the BigQuery API layer by placing the API inside a service perimeter. Any request to BigQuery from outside that perimeter, or any attempt by an internal client to access a resource outside the perimeter, is denied regardless of IAM roles, because the perimeter uses a deny-by-default egress/ingress model. This directly prevents an authorized user from copying BigQuery data to an external project, since the destination project is outside the perimeter and the API call is blocked even if the user has permissions in both projects.
- ✗
An organization policy preventing resource creation outside specific projects
Why it's wrong here
An organization policy that restricts resource creation to specific projects, such as a resource.location constraint, only governs the creation of new GCP resources at deployment time. It does not govern data access, data movement, or API operations on already-existing resources like BigQuery datasets, tables, or jobs. Since the data already exists in BigQuery and the exfiltration occurs by copying that existing data, the policy has no mechanism to intercept a query or export job that writes results to another project, making it ineffective for this scenario.
- ✗
Cloud Armor rules blocking outbound API requests to BigQuery in other projects
Why it's wrong here
Cloud Armor is a web application firewall that filters incoming HTTP/HTTPS traffic to resources fronted by Cloud Load Balancing, protecting against layer 7 attacks such as SQL injection and cross-site scripting. BigQuery APIs, including REST and gRPC requests that perform queries or data exports, are not sent through a load balancer nor do they pass through Cloud Armor; they are made directly to Google-managed service endpoints. Therefore, Cloud Armor has no visibility into, or ability to block, outbound API calls from a user or workload to BigQuery in another project, because it only inspects traffic that is explicitly routed through it.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.