Google PCA Manage implementation of cloud architecture Practice Question

Which TWO of the following are benefits of using a VPC Service Controls perimeter?

⚠ Common exam trap

Google Cloud often tests the misconception that VPC Service Controls are a firewall or encryption mechanism, when in fact they are a context-aware access boundary that works alongside IAM and network controls.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Prevent data exfiltration from managed services like BigQuery and Cloud Storage

VPC Service Controls perimeters are designed to mitigate data exfiltration risks for managed services such as BigQuery, Cloud Storage, and other Google Cloud APIs, so option A is correct because the perimeter restricts data movement across its boundary even when credentials are valid. Option E is also correct because a perimeter defines an authorized boundary (based on VPC networks, projects, and access levels) from which managed services can be reached, effectively allowing access only from authorized VPC networks. Option B is wrong because VPC Service Controls is not a network firewall for Compute Engine instances; that role belongs to VPC firewall rules and hierarchical firewall policies. Option C is wrong because encryption in transit between on-premises and Google Cloud is handled by mechanisms such as Cloud VPN, Cloud Interconnect with MACsec, or application-layer TLS, not by VPC Service Controls. Option D is wrong because VPC Service Controls complements rather than replaces IAM; IAM still governs identities and permissions, while the perimeter adds an independent context-aware boundary.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Prevent data exfiltration from managed services like BigQuery and Cloud Storage
Why this is correct
VPC Service Controls builds a security perimeter around Google-managed services, restricting data movement across its boundary. This directly blocks exfiltration paths such as copying BigQuery datasets or Cloud Storage objects to unauthorised projects, satisfying the containment requirement.
✗
Act as a network firewall for Compute Engine instances
Why it's wrong here
VPC Service Controls restricts which identities and networks may reach Google Cloud services; it does not filter packets to Compute Engine instances, which VPC firewall rules and hierarchical firewall policies do. It is tempting because a perimeter sounds like a network boundary, but it operates on service APIs, not instance traffic.
✗
Provide encryption of data in transit between on-premises and Google Cloud
Why it's wrong here
VPC Service Controls governs access to Google Cloud APIs and services at the perimeter boundary; it does not encrypt traffic between on-premises and Google Cloud, which Cloud VPN or Interconnect with IPsec provides. It is tempting because perimeters do control data movement, but that is API-level exfiltration control, not transport encryption.
✗
Replace Identity and Access Management (IAM) for service access control
Why it's wrong here
VPC Service Controls supplements IAM rather than replacing it; IAM still grants the underlying permissions, and the perimeter only adds a boundary condition around them. It is tempting because perimeters do constrain service access, but removing IAM would leave no principal-level authorisation.
✓
Allow access to Google Cloud services only from within an authorized VPC network
Why this is correct
Perimeter ingress and egress rules evaluate the caller's context, including the source VPC network and project. Access to protected services is granted only when requests originate from an authorised network inside the perimeter, enforcing the network-origin constraint.

Go deeper

Google PCA Manage implementation of cloud architecture Practice Question

Why each option matters

Option-by-option breakdown

Related to this question