Question 158 of 960
hardMultiple ChoiceObjective-mapped
VPC Service Controls Ingress Policy
A security engineer is designing a VPC Service Controls perimeter to protect a project containing sensitive data stored in Cloud Storage and BigQuery. The perimeter currently allows access from an on-premises data center via private connectivity (Cloud Interconnect). The business requires that a third-party SaaS application (outside the perimeter) be able to write data into a specific Cloud Storage bucket. Which action should the engineer take?
Quick Answer
The correct action is to create a service account for the SaaS application, grant it the Storage Object Creator role, and configure an access level that includes the service account, then add that access level to the perimeter's ingress policy. This works because VPC Service Controls ingress policies are the explicit mechanism for allowing traffic from outside the perimeter, and an access level acts as the gatekeeper that identifies the trusted identity. On the Google Professional Cloud Security Engineer exam, this scenario tests your understanding that ingress policies are identity-based, not network-based—a common trap is confusing ingress rules with egress rules or trying to use a VPC firewall instead. Remember that external SaaS access requires an ingress policy with an access level tied to a service account, not just an IP range. Memory tip: “Ingress is Identity”—if it’s outside the perimeter, you must use an access level to let it in.
⚠ Common exam trap
Google Cloud often tests the distinction between VPC Service Controls and IAM permissions, where candidates mistakenly think that granting IAM roles and adding identities to the perimeter is sufficient, ignoring the requirement for explicit ingress policies to allow external access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service account for the SaaS application, grant it the Storage Object Creator role, and configure an access level that includes the service account. Then, add that access level to the perimeter's ingress policy.
VPC Service Controls perimeters use ingress policies to explicitly allow access from outside the perimeter. By creating a service account for the SaaS application, granting it the Storage Object Creator role, and configuring an access level that includes that service account, the engineer can add the access level to the perimeter's ingress policy. This allows the external SaaS application to write data into the specific Cloud Storage bucket while still blocking all other external access, maintaining the security of the sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a service account for the SaaS application and grant it the Storage Object Creator role; then add the service account to the perimeter's allowed identities.
Why it's wrong here
VPC Service Controls does not allow identities; it uses access levels based on client context.
- ✓
Create a service account for the SaaS application, grant it the Storage Object Creator role, and configure an access level that includes the service account. Then, add that access level to the perimeter's ingress policy.
Why this is correct
VPC Service Controls ingress policies can use access levels based on service accounts. This allows the specific service account to write to the bucket while maintaining the perimeter.
- ✗
Create an access level that includes the SaaS application's IP addresses and use that in the perimeter's ingress policy.
Why it's wrong here
Access levels can include IP ranges, but this would allow all traffic from those IPs, not just the specific application.
- ✗
Add the SaaS application's external IP addresses to the perimeter's allowed IP ranges.
Why it's wrong here
VPC Service Controls does not support IP-based allowlisting; it uses access levels based on identity or context.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer is configuring VPC Service Controls to protect a service perimeter. Which TWO conditions must be met for a request to be allowed across the perimeter? (Choose TWO.)
easy- A.The request is made by an identity that belongs to an allowed domain.
- B.The request comes from an allowed IP range.
- C.The request is made by a service account that has been granted access.
- ✓ D.The request includes a valid access context manager access level.
- ✓ E.The request originates from a project within the perimeter.
Why D: The correct answers are D and E. A request is allowed across a VPC Service Perimeter if it originates from a project within the perimeter (E) and includes a valid Access Context Manager access level (D). These two conditions are required. Other conditions like allowed domains, IP ranges, or service accounts are not standalone requirements; they are part of access levels or identity-based controls.
Last reviewed: Jun 30, 2026
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.