Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Armor security policy

  Why it's wrong here

  Cloud Armor security policies protect applications behind a Cloud External HTTPS Load Balancer by providing WAF rules, DDoS protection, and IP-based allow/deny filters at the edge. They do not attach to Cloud Storage's API endpoint or apply context-aware access control to direct API calls to storage.googleapis.com. Because the policy only evaluates traffic hitting the load balancer, it cannot enforce an IP allowlist for the Cloud Storage API itself.

• ✗

  Identity-Aware Proxy (IAP)

  Why it's wrong here

  Identity-Aware Proxy (IAP) provides context-aware access control to applications through OAuth, session management, and signed headers, typically fronted by an HTTPS load balancer or configured for App Engine, Compute Engine, and GKE. It does not integrate with the Cloud Storage JSON or XML API, nor does it intercept requests made directly to the storage.googleapis.com endpoint. IAP is designed for user-based access to web applications, not for programmatic API calls to storage services.

• ✓

  VPC Service Controls with an access level that includes the IP range

  Why this is correct

  VPC Service Controls with an access level that includes the IP range is correct because these perimeters restrict all API calls to protected services like Cloud Storage, and access levels apply context-aware conditions (including source IP address) at the Google Front End. When you add Cloud Storage to a service perimeter and attach an access level with your allowed CIDR range, any API request originating outside that IP range is denied, regardless of IAM permissions. This gives you perimeter-based, context-sensitive enforcement directly on the Cloud Storage API.

• ✗

  VPC firewall rules

  Why it's wrong here

  VPC firewall rules control network traffic between VM instances and subnets based on IP address, port, and protocol at the VPC network layer. They do not apply to Cloud Storage's external API endpoint, which is served from a global Google-managed infrastructure outside your VPC. Even if you set up egress deny rules on a VM, those rules do not affect API calls made from other clients, nor do they filter based on context like the requesting user's IP when the call arrives at the API. Therefore, firewall rules cannot enforce an IP-based condition on the Cloud Storage API itself.

Go deeper

Related to this question