Cloud Digital Leader Trust and security with Google Cloud Practice Question
A retail company uses Google Cloud to run an online store. They have a security requirement that all API calls to Cloud Storage must come from the company's on-premises network only. Which Google Cloud security feature should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls
VPC Service Controls allow you to define perimeters that restrict access to Google Cloud services from specified VPC networks or IP ranges. Cloud Armor is for DDoS and WAF. IAM conditions are for attribute-based access control within a policy. Identity-Aware Proxy protects web applications, not storage APIs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM conditions with source IP constraint
Why it's wrong here
IAM conditions can restrict access based on source IP using policy bindings, but this operates per-principal and per-identity, requiring extensive policy management and providing no network-level isolation. IP-based conditions are evaluated at the request level but do not create a perimetrical boundary around APIs, nor do they block data exfiltration or service-to-service traffic. VPC Service Controls offers broader, context-aware protection beyond mere source IP checks.
- ✓
VPC Service Controls
Why this is correct
VPC Service Controls creates security perimeters around Google Cloud services like Cloud Storage, allowing access only from approved VPC networks or IP ranges. It enforces context-aware policies based on client identity, network, and device at the API layer, and can deny data exfiltration to unauthorized networks. This makes it the precise, comprehensive solution for limiting storage API access from known networks.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor is a DDoS protection and web application firewall service that filters HTTP/S traffic at the edge using IP, geo, and L7 rules. It is designed for load-balanced web applications and cannot enforce access control on storage APIs or direct API calls. It lacks the ability to define perimeters or use IAM context to govern service-to-service API access, making it orthogonal to this requirement.
- ✗
Identity-Aware Proxy (IAP)
Why it's wrong here
Identity-Aware Proxy (IAP) authenticates and authorizes users for web applications and fronted endpoints using OAuth and signed JWT tokens, applying access policies at the application layer. It operates as a reverse proxy for HTTP-based apps, not as a control plane for storage APIs like Cloud Storage's JSON/REST endpoints. Therefore, IAP cannot restrict network-level access to storage services or enforce perimeters.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.