Cloud Digital Leader Trust and security with Google Cloud Practice Question

A company wants to grant a data analyst read-only access to specific BigQuery datasets, but only if the request comes from within the corporate network. Which two Google Cloud tools should they combine to enforce this?

⚠ Common exam trap

Google Cloud often tests the distinction between network-level access control (VPC Service Controls) and identity-level access control (IAP), leading candidates to incorrectly pair IAM with IAP for API-based services like BigQuery.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

IAM and VPC Service Controls

IAM defines the read-only role (e.g., roles/bigquery.dataViewer) for the data analyst, while VPC Service Controls create a security perimeter that restricts access to the BigQuery API from only the corporate network IP range. Together, they ensure the request is both authorized by IAM and originates from within the allowed VPC perimeter, blocking any access from outside the corporate network even if the IAM role is granted.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
IAM and VPC Service Controls
Why this is correct
IAM is the foundation for granting read-only access: roles like roles/bigquery.dataViewer authorize a data analyst to query datasets and tables. VPC Service Controls add an additional, network-level boundary by wrapping BigQuery in a service perimeter that only permits API calls originating from allowed IP addresses (e.g., the corporate network). IAM answers 'who has permission', while VPC-SC answers 'from where the request is allowed' — this combination prevents authorized credentials from being used outside the trusted environment, addressing both authentication and data exfiltration.
✗
IAM and Cloud IAP
Why it's wrong here
IAM alone is correct for managing roles, but Cloud IAP (Identity-Aware Proxy) cannot be used to secure BigQuery. IAP is designed for HTTP/HTTPS web applications, sitting in front of App Engine, Cloud Run, or a load balancer to verify user identity at the L7 layer; it does not intercept or filter BigQuery's REST API calls made by client libraries, SDKs, or the bq command-line tool. Because BigQuery is not a web application with a browser-facing endpoint, IAP cannot enforce network or identity restrictions on its API, so pairing IAM with IAP fails to meet the requirement.
✗
Cloud Armor and IAM
Why it's wrong here
Cloud Armor is a Web Application Firewall and DDoS mitigation service that inspects incoming HTTPS traffic to external HTTP(S) load balancers, applying rules based on IP addresses, geo-location, or custom expressions. It is not an access-control proxy for BigQuery APIs, which use gRPC or REST endpoints that never traverse Cloud Armor. While IAM grants a data analyst read-only roles, Cloud Armor cannot apply network-level restrictions to those API requests, so the combination does not achieve the desired context-aware, network-secured access.
✗
Organization Policies and Cloud Audit Logs
Why it's wrong here
Organization Policies (constraints) enforce guardrails such as restricting resource locations or disabling public IPv4 addresses, but they are administrative rules that can never grant or deny access to a specific user; permissions are always assigned via IAM. Cloud Audit Logs are diagnostic records that capture 'who did what, when' and are invaluable for forensics and compliance, but they have no ability to block or authorize access—they only observe it. Since the data analyst needs read-only access, neither component provides the actual authorization (IAM), making this pair insufficient.

Go deeper

Cloud Digital Leader Trust and security with Google Cloud Practice Question

Why each option matters

Option-by-option breakdown

Related to this question