Cloud Digital Leader Google Cloud Security Practice Question
An administrator wants to enforce that all API calls to a specific Cloud Storage bucket must come from a limited range of IP addresses. Which configuration should they use?
⚠ Common exam trap
GCDL often tests the confusion between network-layer controls (firewall rules, Cloud Armor) and API-layer controls (VPC Service Controls), leading candidates to choose a firewall or load balancer solution for an API-level restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls with an access level that includes the IP range
VPC Service Controls with an access level that includes the specified IP range is the correct way to enforce that API calls to a Cloud Storage bucket originate only from a limited set of IP addresses. Access levels in VPC Service Controls define conditions such as IP ranges, and when attached to a service perimeter, they restrict access to the protected service (Cloud Storage) based on those conditions. This provides centralized, identity- and context-aware enforcement at the API level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Armor security policy
Why it's wrong here
Cloud Armor security policies protect applications behind a Cloud External HTTPS Load Balancer by providing WAF rules, DDoS protection, and IP-based allow/deny filters at the edge. They do not attach to Cloud Storage's API endpoint or apply context-aware access control to direct API calls to storage.googleapis.com. Because the policy only evaluates traffic hitting the load balancer, it cannot enforce an IP allowlist for the Cloud Storage API itself.
- ✗
Identity-Aware Proxy (IAP)
Why it's wrong here
Identity-Aware Proxy (IAP) provides context-aware access control to applications through OAuth, session management, and signed headers, typically fronted by an HTTPS load balancer or configured for App Engine, Compute Engine, and GKE. It does not integrate with the Cloud Storage JSON or XML API, nor does it intercept requests made directly to the storage.googleapis.com endpoint. IAP is designed for user-based access to web applications, not for programmatic API calls to storage services.
- ✓
VPC Service Controls with an access level that includes the IP range
Why this is correct
VPC Service Controls with an access level that includes the IP range is correct because these perimeters restrict all API calls to protected services like Cloud Storage, and access levels apply context-aware conditions (including source IP address) at the Google Front End. When you add Cloud Storage to a service perimeter and attach an access level with your allowed CIDR range, any API request originating outside that IP range is denied, regardless of IAM permissions. This gives you perimeter-based, context-sensitive enforcement directly on the Cloud Storage API.
- ✗
VPC firewall rules
Why it's wrong here
VPC firewall rules control network traffic between VM instances and subnets based on IP address, port, and protocol at the VPC network layer. They do not apply to Cloud Storage's external API endpoint, which is served from a global Google-managed infrastructure outside your VPC. Even if you set up egress deny rules on a VM, those rules do not affect API calls made from other clients, nor do they filter based on context like the requesting user's IP when the call arrives at the API. Therefore, firewall rules cannot enforce an IP-based condition on the Cloud Storage API itself.
Go deeper
Related to this question
Learn chapter
Data Security: Encryption and Access Controls
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
This GCDL question is part of Courseiva's 848-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.