Cloud Digital Leader Google Cloud Security Practice Question
A company wants to ensure that only API calls from within a specific VPC can access their Cloud Storage buckets, even if the bucket is public. Which Google Cloud feature should they use?
⚠ Common exam trap
GCDL often tests the misconception that IAM alone controls all access to Cloud Storage, but VPC Service Controls is the only feature that enforces a network-origin boundary for managed services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls
VPC Service Controls create a service perimeter that restricts access to Google Cloud APIs (including Cloud Storage) so that requests originating outside the perimeter are denied even if the bucket is public or IAM grants access. This is the only feature that enforces a network-origin boundary around managed services like Cloud Storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC firewall rules
Why it's wrong here
VPC firewall rules operate at the network layer, controlling traffic to and from VM instances based on protocols, ports, and IP ranges. They cannot restrict access to Google-managed APIs such as Cloud Storage, because those services are external to your VPC and firewalls don't inspect API calls. They are necessary for basic network hygiene but are not the right mechanism for API-level access control.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor is a distributed denial-of-service protection and web application firewall service that filters HTTP/S traffic at the edge, inspecting requests for attacks like the OWASP Top Ten. It does not provide service-level access control or enforce perimeters for Google Cloud APIs; it only protects your own backend applications. Its role is to mitigate layer 7 attacks, not to decide which internal clients may call Cloud Storage.
- ✗
IAM conditions
Why it's wrong here
IAM conditions allow you to grant conditional permissions based on attributes such as resource tags, dates, or source IP, but they are evaluated during authorization and do not establish a network boundary. You could use an IAM condition requiring a specific IP range, but that still allows requests from outside your VPC if the IP matches, and it doesn't block all traffic outside a perimeter. VPC Service Controls instead provide a broader, context-aware perimeter that can complement IAM.
- ✓
VPC Service Controls
Why this is correct
VPC Service Controls create security perimeters around Google Cloud services like Cloud Storage, restricting which networks, IP ranges, and identities can invoke their APIs. It enforces a context-aware boundary at the service level, preventing data exfiltration and unauthorized access even if an IAM policy is misconfigured. When the goal is 'only API calls from within', VPC Service Controls are the correct mechanism because they block access from outside the defined perimeter regardless of IAM permissions.
Go deeper
Related to this question
Learn chapter
PaLM API and Google AI APIs
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every GCDL question from scratch — 848 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.