Cloud Digital Leader Google Cloud Security Practice Question
A company wants to ensure that its Google Cloud resources can only be accessed from within a specific VPC network, preventing data exfiltration to the internet. They need to enforce this for Cloud Storage and BigQuery APIs. Which service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls
VPC Service Controls create perimeters around managed services to restrict access to only allowed VPC networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud NAT
Why it's wrong here
Cloud NAT enables outbound internet connections from private VM instances without external IP addresses by translating their private IPs to a NAT IP. It does not restrict access to Google Cloud managed services or prevent data egress; rather, it facilitates egress, making it a connectivity feature rather than a security control.
- ✓
VPC Service Controls
Why this is correct
VPC Service Controls define security perimeters around Google Cloud resources such as Cloud Storage and BigQuery, using context-aware access conditions (identity, IP, device) to block data exfiltration. It works at the API layer, independent of VPC network boundaries, and is the only option here that actively restricts data movement outside a defined perimeter.
- ✗
VPC Firewall Rules
Why it's wrong here
VPC Firewall Rules govern traffic at the network layer for VM instances, filtering packets based on source/destination IP, protocol, and port. They do not apply to Google Cloud managed services like Cloud Storage, which are accessed via public API endpoints, and cannot prevent data exfiltration from those services because the requests never traverse the VPC network.
- ✗
Private Google Access
Why it's wrong here
Private Google Access allows VM instances without external IPs to reach Google Cloud APIs using private network addressing, routing traffic over the Google network rather than the internet. It expands connectivity for internal resources but does not restrict access to data or create security perimeters, so it cannot stop data exfiltration from managed services.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.