PCNE Implementing VPC Instances Practice Question
A company wants to allow access to a Cloud Storage bucket only from Compute Engine instances that have a specific service account and are within a specific VPC. They also want to prevent access from other networks. Which TWO services or features should they use together?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAM conditions on the bucket
VPC Service Controls can restrict access to Google APIs to only specified VPCs and projects, creating a service perimeter. IAM conditions can further restrict access based on the caller's service account. This combination ensures that only instances with the correct service account in the correct VPC can access the bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hierarchical firewall policy
Why it's wrong here
Controls network traffic, not API access.
- ✗
Cloud Armor
Why it's wrong here
Provides DDoS and WAF protection, not access control.
- ✓
IAM conditions on the bucket
Why this is correct
Allows you to conditionally grant access based on the caller's service account.
- ✓
VPC Service Controls
Why this is correct
Creates a service perimeter that restricts API access to the specified VPC.
- ✗
Cloud NAT
Why it's wrong here
Provides outbound internet access, not access control.
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.