An enterprise is designing a secure cloud architecture on Google Cloud across multiple projects. The architecture utilizes a Shared VPC where compute workloads deployed in a service project interact with managed Google Cloud APIs. The security team establishes the following requirements: Guard against data exfiltration by enforcing a VPC Service Controls perimeter around sensitive Google Cloud APIs. Ensure network communication between the Shared VPC host project and the service project is fully permitted without perimeter boundary violations. Allow authorized security administrators connecting from corporate public IP addresses to access and manage protected services via the Google Cloud console. Which solution should you implement?

Place both the Shared VPC host project and the service project within the same VPC Service Controls perimeter, create an Access Context Manager access level containing the corporate public IP ranges, and assign that access level to the perimeter.: ### What VPC Service Controls and Access Context Manager Are **VPC Service Controls** establishes an isolation perimeter around Google Cloud resources to prevent unauthorized access and mitigate data exfiltration risks. **Access Context Manager** allows administrators to define fine-grained, context-aware access levels based on attributes such as client IP subnets, device policy, and user identity, which can then be bound directly to VPC Service Controls service perimeters. ### How it Meets the Stated Requirements - **Preventing data exfiltration:** Encapsulating sensitive projects and APIs within a **VPC Service Controls service perimeter** prevents data from being copied or exfiltrated to unauthorized storage locations or unauthorized multi-tenant services outside the perimeter. - **Shared VPC compatibility:** Including both the **Shared VPC host project** and the **service project** in the exact same service perimeter ensures network interfaces, cross-project subnet bindings, and API requests between them do not cross perimeter boundaries, avoiding unexpected policy violations. - **Google Cloud console administration:** Because the **Google Cloud console** operates over the public internet outside the perimeter boundary, defining an **access level** in Access Context Manager configured with the corporate public IP CIDR blocks and attaching it to the perimeter grants authorized personnel seamless console access to the protected services. ### Key Advantages and Capabilities - **Unified perimeter defense:** Restricts access to sensitive Google API endpoints (such as Cloud Storage and BigQuery) from unapproved networks and identities. - **Granular context evaluation:** Enforces IP subnet and identity conditions without compromising private API security. - **Seamless Shared VPC integration:** Prevents communication failures between network infrastructure admins and application developers. - **Multi-layered protection:** Complements IAM permissions by placing network-level restrictions on API access. ### Why This Is Optimal This solution natively addresses both cross-project networking constraints in Shared VPC deployments and the operational requirement of console management from verified enterprise networks without weakening perimeter isolation.

StudyCerts

Secure Network Perimeter Vpc Sc Console Access | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Secure Network Perimeter Vpc Sc Console Access

Section: Security and compliance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a secure cloud architecture on Google Cloud across multiple projects. The architecture utilizes a Shared VPC where compute workloads deployed in a service project interact with managed Google Cloud APIs. The security team establishes the following requirements:

Guard against data exfiltration by enforcing a VPC Service Controls perimeter around sensitive Google Cloud APIs.
Ensure network communication between the Shared VPC host project and the service project is fully permitted without perimeter boundary violations.
Allow authorized security administrators connecting from corporate public IP addresses to access and manage protected services via the Google Cloud console.

Which solution should you implement?

Place both projects in the service perimeter, enable Private Services Access, and configure VPC firewall rules matching the corporate IP addresses to permit Google Cloud console traffic.

Place only the Shared VPC service project inside the perimeter, configure an Identity-Aware Proxy (IAP) TCP forwarding tunnel for Google Cloud console traffic, and rely on IAM conditions to govern the host project.

Create separate VPC Service Controls perimeters for the host project and service project, deploy an external Application Load Balancer with Cloud Armor edge policies, and route console access through Cloud NAT.

Place both the Shared VPC host project and the service project within the same VPC Service Controls perimeter, create an Access Context Manager access level containing the corporate public IP ranges, and assign that access level to the perimeter.

Professional Cloud Architect

Secure Network Perimeter Vpc Sc Console Access

Related questions