PDE Storing the Data Practice Question
A company stores sensitive customer data in BigQuery and Cloud Storage. They want to encrypt the data with customer-managed encryption keys (CMEK) and ensure that access to the key material is restricted to only approved networks. Which additional Google Cloud control should they implement to enforce network-based access to the encryption keys?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls
VPC Service Controls (VPC-SC) can create a security perimeter around Cloud KMS and BigQuery/Cloud Storage resources, preventing data exfiltration and restricting access to approved networks. VPC-SC works with CMEK to add an extra layer of network-based access control. Cloud Armor is for HTTP(S) load balancing, IAP is for user identity, and Private Google Access is for on-premises access to public IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity-Aware Proxy (IAP)
Why it's wrong here
IAP controls access to applications based on user identity and context, not network restrictions for KMS.
- ✗
Private Google Access
Why it's wrong here
Private Google Access enables on-premises hosts to reach Google APIs using private IPs, but does not enforce network-based access policies on KMS.
- ✓
VPC Service Controls
Why this is correct
VPC Service Controls allow you to define a security perimeter around Google Cloud services, including Cloud KMS, to restrict access based on network origin.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor provides DDoS protection and WAF capabilities, not network-based access control to KMS keys.
Go deeper
Related to this question
About these practice questions
This PDE question is part of Courseiva's 890-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PDE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PDE exam.