Cloud Digital Leader Trust and security with Google Cloud Practice Question
An organization wants to ensure that Google Cloud services used by its employees cannot be used to exfiltrate data to a competitor's Google Cloud project. For example, they want to prevent copying data from their Cloud Storage bucket to a Storage bucket owned by a competitor. Which Google Cloud security control most directly prevents this type of insider data exfiltration?
⚠ Common exam trap
Many candidates confuse IAM permissions with network-level controls, assuming that restricting IAM access to competitor projects is sufficient, but VPC Service Controls are the only mechanism that enforces a boundary at the API layer regardless of user identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls, which create a security perimeter around Google Cloud APIs so data cannot be moved to projects outside the defined perimeter
VPC Service Controls (C) directly prevent data exfiltration by creating a security perimeter around Google Cloud APIs. This perimeter blocks any data movement to resources outside the defined perimeter, such as a competitor's Cloud Storage bucket, regardless of the user's IAM permissions. It works at the API layer, intercepting requests that attempt to copy data to an unauthorized project.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM permissions that restrict users from accessing competitor projects
Why it's wrong here
IAM permissions grant or deny actions on resources within your own Google Cloud resource hierarchy (projects, folders, org); you cannot attach an IAM policy to a competitor's project or any resource you don't own. Even a highly restrictive IAM policy is only an identity-based access check — it cannot inspect the destination of an API call, so a user with read access to a dataset inside your project can read it and re-upload that data to a GCS bucket in any external project without ever tripping an IAM rule.
- ✗
Cloud DLP, by scanning and redacting sensitive data before it can be stored
Why it's wrong here
Cloud DLP inspects content and applies transformations (redaction, masking, tokenization) at the API level; it's designed for data classification and de-identification, not as a data movement boundary. If a user calls the Storage API to copy an object from your project to an external bucket, Cloud DLP is not in that data path unless you've explicitly configured streaming/inspection on that specific copy operation, and even then it doesn't deny the copy — it only modifies or flags content. DLP operates on data content, not on the egress path or the destination context, so it cannot prevent an authorized insider from exfiltrating data with standard APIs.
- ✓
VPC Service Controls, which create a security perimeter around Google Cloud APIs so data cannot be moved to projects outside the defined perimeter
Why this is correct
VPC Service Controls are precisely designed for this. A service perimeter defines which projects can exchange data with each other. Even if a user has valid credentials, the API enforces that data cannot be read from inside the perimeter and written outside it — blocking the insider exfiltration pattern described.
- ✗
Organization Policy constraints that prevent resource creation in competitor accounts
Why it's wrong here
Organization Policy constraints are enforced by the organization policy service on nodes inside your own organization hierarchy, so they cannot be assigned to a competitor's organization or to projects outside your domain. Even within your org, constraints like 'restrict bucket locations' or 'disable service account key creation' control resource configuration and creation, not the flow of data; they would not stop a user from creating a bucket in an attacker-controlled project and copying data there, because that external project is governed by the attacker's own org policy, if any.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security control
A security control is a safeguard or countermeasure designed to protect the confidentiality, integrity, and availability of information systems and data.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.