Google PCA Design for security and compliance Practice Question
A large e-commerce company runs its production workloads on Google Cloud. The security team has implemented a VPC Service Controls perimeter around the production project to prevent data exfiltration. The perimeter includes the project, and access is allowed only from an access level that requires the user to be on the corporate network (192.0.2.0/24). Recently, the DevOps team reported that their CI/CD pipeline, which runs on Cloud Build with a VPC connector attached to a shared VPC in a different project, is failing to deploy to Cloud Run. The pipeline uses a service account with roles/run.admin on the production project. The Cloud Build worker IPs are ephemeral and not in the corporate IP range. The pipeline's deployment step times out with permission errors. Which action will resolve the issue while maintaining security compliance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the Cloud Build service account as a member of the access level used in the perimeter, so that it is not restricted by IP.
Adding the Cloud Build service account as a member of the access level allows it to bypass the IP restriction. In VPC Service Controls, access levels can include both IP conditions and members. By adding the service account as a member, the perimeter still enforces IP restrictions for other users, but the service account is allowed through based on its identity, not its IP. This resolves the deployment failure while maintaining the security perimeter. Option B is wrong because removing the perimeter defeats the security requirement. Option C is wrong because adding 0.0.0.0/0 would allow all IPs, weakening security. Option D is wrong because changing the service account does not change the ephemeral nature of the Cloud Build worker IPs; the permission error is due to IP restriction, not IAM roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the Cloud Build service account as a member of the access level used in the perimeter, so that it is not restricted by IP.
Why this is correct
Access levels can include service accounts as members, allowing them to bypass IP restrictions.
- ✗
Remove the VPC Service Controls perimeter from the production project and rely solely on IAM permissions.
Why it's wrong here
This removes the data exfiltration protection entirely.
- ✗
Add the Cloud Build worker IP range (0.0.0.0/0) to the access level's IP condition to allow all IPs.
Why it's wrong here
This would bypass the IP restriction and allow any IP, reducing security.
- ✗
Create a new service account for Cloud Build with roles/iam.serviceAccountUser and roles/run.admin, and assign it to the Cloud Run service.
Why it's wrong here
This does not change the IP address of the Cloud Build workers.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
VPC Service Controls
VPC Service Controls is a Google Cloud security feature that protects the data of managed services by defining perimeters that prevent data exfiltration and unauthorized access across public networks.
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.