PCNE Implementing network security Practice Question
An organization wants to restrict access to a Cloud Storage bucket so that only VMs within a specific VPC network can download objects. They are using VPC Service Controls and Private Google Access. Which configuration is required?
⚠ Common exam trap
Google Cloud often tests the misconception that firewall rules alone (Option C) or NAT (Option A) are sufficient for restricting access, when in fact VPC Service Controls are required to enforce network-level boundaries beyond IAM and connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Private Google Access on the subnet and create a VPC Service Controls perimeter that includes the bucket project
D is correct because VPC Service Controls create a security perimeter around the Cloud Storage bucket's project, preventing data exfiltration even if the bucket is publicly accessible. Private Google Access on the subnet allows VMs to reach Google APIs (including storage.googleapis.com) via internal IPs, avoiding the public internet. Together, they ensure only VMs within the specified VPC network can download objects, as the perimeter restricts access to authorized networks and Private Google Access provides the private connectivity path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Cloud NAT and configure a firewall rule to allow egress to 0.0.0.0/0
Why it's wrong here
Cloud NAT provides internet access, but for Google APIs Private Google Access is sufficient and more secure.
- ✗
Configure a Service Directory endpoint and attach an IAM policy to the bucket allowing access only from that endpoint
Why it's wrong here
Service Directory is not used for network access control to Cloud Storage.
- ✗
Create a firewall rule allowing egress to the storage.googleapis.com service IP range and enable VPC flow logs
Why it's wrong here
Firewall rule alone does not restrict access to a specific VPC; VPC Service Controls is needed.
- ✓
Enable Private Google Access on the subnet and create a VPC Service Controls perimeter that includes the bucket project
Why this is correct
Private Google Access enables internal IP access to Google APIs, and VPC Service Controls restricts access to the perimeter.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.