hardMultiple ChoiceObjective-mapped
PCSE Practice Question: Is configuring VPC Service Controls to protect a…
A security engineer is configuring VPC Service Controls to protect a Google Cloud project containing sensitive data. The project uses Cloud Storage and BigQuery. The engineer wants to ensure that data cannot be exfiltrated to external IP addresses outside the perimeter, but internal users should still be able to access the data from on-premises via a VPN. Which configuration should be applied?
⚠ Common exam trap
Google Cloud often tests the misconception that VPC Service Controls are a simple on/off switch, but the trap here is that without explicit ingress rules, all external traffic (including from VPNs) is denied, so candidates must remember to configure ingress rules for authorized sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges
VPC Service Controls (VPC-SC) allow you to define a security perimeter around Google Cloud services like Cloud Storage and BigQuery, preventing data exfiltration to external IPs. By adding the project to a perimeter and configuring an ingress rule that permits traffic from the on-premises VPN CIDR ranges, internal users can access the data via VPN while all other external traffic is blocked. This meets the requirement of preventing exfiltration to external IPs while allowing authorized on-premises access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access
Why it's wrong here
IAM and firewalls do not prevent data exfiltration to external IPs outside the perimeter.
- ✓
Add the project to a VPC Service Controls perimeter and configure an ingress rule to allow traffic from the on-premises VPN CIDR ranges
Why this is correct
Ingress rules allow specific external sources (like VPN CIDR) to access the perimeter.
- ✗
Create a separate perimeter that denies all traffic and apply it to the project
Why it's wrong here
This would deny all access, including from VPN.
- ✗
Add the project to a VPC Service Controls perimeter with no additional ingress rules
Why it's wrong here
This would block access from on-premises via VPN because VPN traffic originates outside the perimeter.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.