How to Enforce VPC Service Controls on All Projects in a Folder
During the bootstrapping of a Google Cloud organization, you need to ensure that all resources in a specific folder are subject to a particular VPC Service Controls perimeter. Which step is necessary to achieve this?
Quick Answer
The correct step is to add the projects within the folder as members of the existing service perimeter. This is because VPC Service Controls perimeters are enforced at the project level, not at the folder or organization level; the folder itself cannot be a perimeter member. To apply a VPC Service Controls perimeter to all resources in a folder, you must explicitly add each project under that folder to the perimeter’s project list, which then restricts data exfiltration and access for all resources within those projects. On the Google Professional Cloud DevOps Engineer exam, this concept tests your understanding of how perimeter boundaries map to resource hierarchy—a common trap is assuming folders inherit perimeter membership automatically, when in fact only projects can be members. A useful memory tip: “Perimeters protect projects, not folders—add the projects, not the path.”
⚠ Common exam trap
Google Cloud often tests the misconception that VPC Service Controls can be applied hierarchically (e.g., to folders or via organization policies), when in fact they require explicit project-level membership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the projects within the folder as members of the existing service perimeter.
VPC Service Controls perimeters are applied at the project level, not directly to folders. To enforce a perimeter on all resources within a folder, you must add each project in that folder as a member of the existing service perimeter. This ensures that all resources in those projects are subject to the perimeter's access restrictions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use resource tags to label the projects and then create a tag-based perimeter.
Why it's wrong here
There is no tag-based perimeter; perimeters are based on project membership.
- ✗
Apply the perimeter to the folder directly.
Why it's wrong here
Perimeters cannot be applied directly to folders.
- ✓
Add the projects within the folder as members of the existing service perimeter.
Why this is correct
Projects must be explicitly added to the perimeter.
- ✗
Create an organization policy that forces all projects in the folder to be in a perimeter.
Why it's wrong here
Organization policies can enforce that projects are in a perimeter, but you still need to create and assign the perimeter.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCDOE question from scratch — 486 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCDOE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is setting up a new Google Cloud organization for DevOps. They want to enforce that all projects have a specific set of VPC Service Controls perimeters. Which approach should they use to ensure these perimeters are automatically applied to all new projects?
medium- A.Configure Cloud Shell to run a script that creates a perimeter when a new project is created.
- ✓ B.Define an organization policy with a constraint that requires all projects to be within a perimeter.
- C.Use Deployment Manager to deploy a configuration that creates a perimeter for each new project.
- D.Create a VPC Service Controls perimeter and add the organization node as a member.
Why B: Google Cloud Organization Policies allow you to define and enforce constraints at the organization, folder, or project level. The `constraints/compute.restrictVpcServiceControls` constraint can be set to require all new projects to be within a specific VPC Service Controls perimeter, ensuring automatic enforcement without manual intervention.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDOE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDOE exam.