An enterprise is deploying confidential workloads onto Compute Engine instances within a custom VPC subnet that has no external IP addresses and no default internet gateway route. The security team has defined a VPC Service Controls (VPC-SC) perimeter protecting services such as Cloud Storage and BigQuery. To enforce strict perimeter boundaries and prevent data exfiltration, the architecture must satisfy these criteria: Compute Engine instances must communicate privately with Google APIs using internal routing. Instances must be blocked from sending requests to Google APIs and services that are not supported by VPC Service Controls. Network routes and DNS resolution within the VPC must guarantee that all API traffic resolves exclusively to the restricted VIP range. Which network and DNS configuration should the security engineer implement?

Enable Private Google Access on the subnet, create a Cloud DNS private zone for `googleapis.com` with a CNAME record directing `*.googleapis.com` to `restricted.googleapis.com`, and map `restricted.googleapis.com` to `199.36.153.4/30`.: ### What the restricted.googleapis.com VIP is The `restricted.googleapis.com` virtual IP (VIP) address range (`199.36.153.4/30` for IPv4) is a specialized Google Cloud endpoint designed specifically to integrate with **VPC Service Controls**. When workloads route API traffic to this VIP, Google Cloud only accepts API calls directed to services that support VPC Service Controls perimeters. ### How it meets the requirements - **Internal Private Connectivity:** Enabling **Private Google Access** on the subnet allows VM instances without external IP addresses to reach Google API VIPs over internal Google network routing. - **Blocking Unsupported Services:** Directing traffic to `restricted.googleapis.com` automatically drops or rejects requests targeting Google services that do not support VPC Service Controls. This prevents workloads from exfiltrating data via unvetted, non-perimeter-protected APIs. - **Deterministic DNS Routing:** Configuring a private Cloud DNS response policy or private zone for `googleapis.com` with a wildcard CNAME to `restricted.googleapis.com` ensures that all VM API calls natively resolve to `199.36.153.4/30`. ### Key advantages - **Data Exfiltration Mitigation:** Ensures egress traffic from VMs cannot reach unauthorized consumer services or unsupported Google APIs. - **Native VPC Integration:** Works seamlessly with existing VPC routing tables and internal DNS resolution mechanisms. - **Strict Perimeter Enforcement:** Guarantees that IAM and perimeter ingress/egress rules are evaluated for every API invocation. - **Zero Internet Exposure:** Completely avoids assigning public IP addresses or deploying NAT gateways. ### Why this is optimal Routing to `restricted.googleapis.com` is the Google Cloud best practice for environments governed by VPC Service Controls. It ensures that traffic cannot bypass perimeter security boundaries while keeping network traffic entirely private.

Vpc Service Controls Restricted Vip Dns Config | Professional Cloud Security Engineer

Vpc Service Controls Restricted Vip Dns Config

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is deploying confidential workloads onto Compute Engine instances within a custom VPC subnet that has no external IP addresses and no default internet gateway route. The security team has defined a VPC Service Controls (VPC-SC) perimeter protecting services such as Cloud Storage and BigQuery.

To enforce strict perimeter boundaries and prevent data exfiltration, the architecture must satisfy these criteria:

Compute Engine instances must communicate privately with Google APIs using internal routing.
Instances must be blocked from sending requests to Google APIs and services that are not supported by VPC Service Controls.
Network routes and DNS resolution within the VPC must guarantee that all API traffic resolves exclusively to the restricted VIP range.

Which network and DNS configuration should the security engineer implement?

Configure Private Services Access with a VPC Network Peering connection to Google services and deploy a Cloud NAT gateway with Endpoint-Independent Mapping.

Enable Private Google Access on the subnet, create a Cloud DNS private zone for googleapis.com with a CNAME record directing *.googleapis.com to private.googleapis.com, and map private.googleapis.com to 199.36.153.8/30.

Enable Private Google Access on the subnet, create a Cloud DNS private zone for googleapis.com with a CNAME record directing *.googleapis.com to restricted.googleapis.com, and map restricted.googleapis.com to 199.36.153.4/30.

Deploy a Serverless VPC Access connector in a dedicated /28 subnet and configure custom egress firewall rules blocking destination port 443 for default gateway routes.

Professional Cloud Security Engineer

Vpc Service Controls Restricted Vip Dns Config

Related questions