Cloud Digital Leader Google Cloud Security Practice Question
A company wants to ensure that only API calls from within a specific VPC can access their Cloud Storage buckets, even if the bucket is public. Which Google Cloud feature should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls
VPC Service Controls allow creating perimeters that restrict access to Google Cloud services to trusted VPCs and IP ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC firewall rules
Why it's wrong here
VPC firewall rules operate at the network layer, controlling traffic to and from VM instances based on protocols, ports, and IP ranges. They cannot restrict access to Google-managed APIs such as Cloud Storage, because those services are external to your VPC and firewalls don't inspect API calls. They are necessary for basic network hygiene but are not the right mechanism for API-level access control.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor is a distributed denial-of-service protection and web application firewall service that filters HTTP/S traffic at the edge, inspecting requests for attacks like the OWASP Top Ten. It does not provide service-level access control or enforce perimeters for Google Cloud APIs; it only protects your own backend applications. Its role is to mitigate layer 7 attacks, not to decide which internal clients may call Cloud Storage.
- ✗
IAM conditions
Why it's wrong here
IAM conditions allow you to grant conditional permissions based on attributes such as resource tags, dates, or source IP, but they are evaluated during authorization and do not establish a network boundary. You could use an IAM condition requiring a specific IP range, but that still allows requests from outside your VPC if the IP matches, and it doesn't block all traffic outside a perimeter. VPC Service Controls instead provide a broader, context-aware perimeter that can complement IAM.
- ✓
VPC Service Controls
Why this is correct
VPC Service Controls create security perimeters around Google Cloud services like Cloud Storage, restricting which networks, IP ranges, and identities can invoke their APIs. It enforces a context-aware boundary at the service level, preventing data exfiltration and unauthorized access even if an IAM policy is misconfigured. When the goal is 'only API calls from within', VPC Service Controls are the correct mechanism because they block access from outside the defined perimeter regardless of IAM permissions.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.