Cloud Digital Leader Practice Question: A company's security team wants to control which…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  VPC firewall rules that control inbound and outbound network traffic to VMs based on IP ranges, protocols, and ports

  Why this is correct

  VPC firewall rules are the correct answer. They are stateful, software-defined firewalls applied to VM network interfaces in Google Cloud VPCs. Rules specify what traffic is allowed or denied based on source/destination IPs, protocols, and ports — providing precise control over which internet resources can communicate with the VMs.

• ✗

  Cloud IAM policies that grant or deny permissions for external systems to access VM resources

  Why it's wrong here

  Cloud IAM authenticates principals and authorizes Google Cloud management operations (e.g., creating VMs, editing firewall rules, reading logs), but it does not inspect or filter data-plane network packets. IAM roles grant permissions on resources like compute instances for API calls, not the ability for an arbitrary internet host to open a TCP session to a VM's port. Firewall rules operate at the VPC network layer and are enforced by the hypervisor/network fabric, independent of any IAM principal's identity; thus IAM policies cannot substitute for VPC firewall rules in controlling inbound/outbound connectivity.

• ✗

  Cloud Storage bucket policies that restrict access to VM storage volumes

  Why it's wrong here

  Cloud Storage bucket policies (IAM bindings or ACLs) govern access to objects in GCS, which is key-value object storage — not to virtual disks that VMs use. Persistent disks (PD) and local SSDs are block storage attached to VM instances; network traffic to those volumes is not filtered by bucket policies. Even if a bucket policy granted broad access, it would not affect which internet hosts can reach a VM's IP: only VPC firewall rules evaluate source/destination IP, protocol, and port to allow or deny traffic.

• ✗

  DNS records that determine which internet addresses can resolve the VM's hostname

  Why it's wrong here

  DNS records map human-readable names to IP addresses; they do not enforce any admission control for connections to a VM. A public A record can be resolved by anyone on the internet — DNS does not limit which addresses may resolve it, and a successful resolution does not mean the VM will accept packets. In Google Cloud, the network path is controlled by stateful VPC firewall rules that match on connection attributes; DNS TTL and record edits affect name resolution, not packet forwarding or firewall admission.

Go deeper

Related to this question