An enterprise protects sensitive workloads across multiple projects inside a VPC Service Controls regular service perimeter. The security engineering team must satisfy two integration and governance requirements: Allow Vulnerability Assessment for Google Cloud to scan virtual machine (VM) instances located inside the protected service perimeter. Allow security administrators working outside the perimeter to perform management operations via the Google Cloud console and gcloud CLI, strictly restricted to requests originating from verified corporate IP ranges. Which solution should the security architect implement to meet these requirements while maintaining least privilege boundary segmentation?

Assign the Access Context Manager Editor role, define an access level restricting source corporate IP subnets, configure perimeter ingress rules matching the access level and administrative identities, and configure perimeter ingress and egress rules that explicitly allow the Cloud Security Command Center Service Agent identity.: ### What the solution is This solution uses **Access Context Manager** and granular **VPC Service Controls ingress and egress rules** to establish context-aware, directional communication channels through a secure service perimeter. By pairing contextual access levels with explicit service agent identities, the organization enforces perimeter boundary segmentation without exposing internal resources to unauthorized external entities. ### How it meets the requirements - **Administrative access via console and CLI**: Ingress rules for VPC service perimeters enable fine-grained, context-aware administrative access from outside the perimeter to resources inside. Defining an **Access Context Manager access level** that matches corporate IP subnets ensures that administrators using the Google Cloud console or `gcloud` CLI can only reach protected management APIs when connected from authorized corporate networks. - **Vulnerability Assessment integration**: Vulnerability Assessment for Google Cloud requires both ingress and egress communication across the service perimeter to discover and inspect VM workloads. Adding targeted ingress and egress rules that explicitly designate the **Cloud Security Command Center Service Agent** (`service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com`) allows the scanner to operate across the boundary while denying all other unauthorized traffic. - **Administrative permissions**: Applying these configurations requires the **Access Context Manager Editor** (`roles/accesscontextmanager.policyEditor`) IAM role at the organization level to modify the perimeter's access policy and directional rules. ### Key advantages and capabilities - **Granular authorization**: Ingress and egress rules allow specifying individual API methods, services, and identities rather than opening entire projects. - **Contextual security**: Enforces contextual attributes (such as source IP CIDR blocks) using Access Context Manager access levels rather than static network routes. - **Least privilege enforcement**: Limits scanner access strictly to the dedicated Security Command Center service agent identity. - **Comprehensive perimeter integrity**: Preserves boundary isolation against data exfiltration across all other non-exempt services and principals. ### Why this is optimal This approach aligns with Google Cloud security best practices by avoiding perimeter bridges for asymmetric access patterns, preventing overly permissive trust zones, and maintaining explicit, auditable policy rules for service-to-service and user-to-service communications.

Configure Vpc Sc Ingress Egress Rules | Professional Cloud Security Engineer

Configure Vpc Sc Ingress Egress Rules

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise protects sensitive workloads across multiple projects inside a VPC Service Controls regular service perimeter. The security engineering team must satisfy two integration and governance requirements:

Allow Vulnerability Assessment for Google Cloud to scan virtual machine (VM) instances located inside the protected service perimeter.
Allow security administrators working outside the perimeter to perform management operations via the Google Cloud console and gcloud CLI, strictly restricted to requests originating from verified corporate IP ranges.

Which solution should the security architect implement to meet these requirements while maintaining least privilege boundary segmentation?

Create a VPC Service Controls perimeter bridge connecting the sensitive service perimeter to an unsegmented public perimeter, and grant the Project Editor role to all security administrators.

Deploy a centralized Next-Generation Firewall (NGFW) in a Network Virtual Appliance (NVA) and assign the Default Compute Engine Service Account to handle cross-perimeter scanning requests.

Assign the Access Context Manager Editor role, define an access level restricting source corporate IP subnets, configure perimeter ingress rules matching the access level and administrative identities, and configure perimeter ingress and egress rules that explicitly allow the Cloud Security Command Center Service Agent identity.

Configure Access Context Manager access bindings for user groups, disable the no-egress traffic policy at the project level, and allow users to authenticate using service account keys.

Professional Cloud Security Engineer

Configure Vpc Sc Ingress Egress Rules

Related questions