PCNE Implementing network security Practice Question
A company is implementing VPC Service Controls to protect a managed project containing BigQuery datasets. They want to allow access from a specific service account in a different project. Which two configurations are required? (Choose TWO.)
⚠ Common exam trap
Google Cloud often tests the misconception that network-level controls (firewall rules, Private Google Access) can bypass VPC Service Controls, but the perimeter operates at the API layer and requires explicit project inclusion and IAM permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the project containing the service account to the VPC Service Controls perimeter
VPC Service Controls use a perimeter to restrict access to managed services like BigQuery. Adding the project containing the service account to the perimeter allows that service account to access the protected BigQuery datasets, as the perimeter explicitly includes the project as an allowed member.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the project containing the service account to the VPC Service Controls perimeter
Why this is correct
Accessible resources are limited to perimeters that include the client project.
- ✗
Create a firewall rule in the client VPC allowing egress to the BigQuery API
Why it's wrong here
Firewall rules are not managed by VPC Service Controls; they are separate.
- ✗
Configure an IAM condition on the service account's roles to restrict access to the perimeter
Why it's wrong here
IAM conditions can be used but are not required; the perimeter itself restricts access.
- ✓
Grant the appropriate IAM roles (e.g., BigQuery Data Viewer) to the service account on the BigQuery dataset
Why this is correct
Even with perimeter, the service account still needs IAM permissions to access the dataset.
- ✗
Enable Private Google Access on the subnet where the service account's VMs are located
Why it's wrong here
Private Google Access enables internal IP access to Google APIs but is not required for VPC Service Controls.
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.