Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
VPC Service Controls
Topic in 31 exam domains
- VPC Service Controls · Service
- VPC Service Controls · Feature
Also called: Virtual Private Cloud (VPC) Service Controls, VPC SC, VPC Service Control, VPC Service Controls rules, VPC-SC, VPC-Service Controls, VPCSC
A security feature that enables organizations to define secure perimeters to prevent data exfiltration.
Where this appears on the exam
22 objectives in 5 of 5 domains
~22% of exam
- Identity and Access Management (e.g., Cloud IAM and organization policies)
- Regional considerations (data sovereignty) for data access and storage
- Legal and regulatory compliance
- Designing the project, dataset, and table architecture to ensure proper data governance
- Multi-environment use cases (development vs. production)
~25% of exam
Domain 3
Storing the data~20% of exam
~15% of exam
~18% of exam
Related topics
This topicWorks alongsideApplied
VPC Service ControlsService
Identity and Access ManagementServiceApplication Default CredentialsFeaturecustomer-managed encryption keysFeatureCloud Audit LogsServiceBigQueryServiceManaged Service for Apache AirflowServiceCloud StorageServiceBatchServiceCloud SQLServiceArtifact RegistryServiceBackup and DRServiceFirestoreServiceGemini EnterpriseServiceKnowledge CatalogServiceNetwork Connectivity CenterServiceCloud LoggingServiceCloud MonitoringServiceCloud RunServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- VPC Service Controls secures BigQuery From the official documentation: “BigQuery data is protected with VPC Service Controls”
- VPC Service Controls secures Cloud Storage From the official documentation: “Storage Transfer Service supports transfers to Cloud Storage buckets protected by VPC Service Controls.”
- Cloud Audit Logs works with VPC Service Controls From the official documentation: “VPC Service Controls integrate with Cloud Audit Logs to monitor access to the control plane.”
- VPC Service Controls secures Managed Service for Apache Airflow From the official documentation: “Managed Airflow can be selected as a secured service inside a VPC Service Controls perimeter.”
- Managed Service for Apache Airflow works with VPC Service Controls From the official documentation: “When used with Managed Airflow, VPC Service Controls have several [known limitations](/vpc-service-controls/docs/supported-products#composer).”
- VPC Service Controls secures Artifact Registry From the official documentation: “If your VPC Service Controls settings are blocking access to Artifact Registry, you must add the Artifact Registry service to the service perimeter of your VPC Service Controls.”
- VPC Service Controls secures Cloud SQL From the official documentation: “VPC Service Controls perimeters protect the Cloud SQL Admin API.”
- VPC Service Controls secures Gemini Enterprise From the official documentation: “The API for Gemini Enterprise can be protected by VPC Service Controls and the product can be used normally inside service perimeters.”
- VPC Service Controls secures Network Connectivity Center From the official documentation: “To further secure your NCC resources, use VPC Service Controls.”
- Batch works with VPC Service Controls From the official documentation: “This document explains how to use VPC Service Controls with Batch.”
- Firestore works with VPC Service Controls From the official documentation: “Because Firestore with MongoDB compatibility is compliant with VPC Service Controls, you can use this domain in VPC Service Controls scenarios.”
- Identity and Access Management works with VPC Service Controls From the official documentation: “VPC Service Controls perimeters and Identity and Access Management (IAM) roles work together.”
- VPC Service Controls secures Backup and DR From the official documentation: “Enclose backup operations within VPC Service Controls security perimeters to help secure your backup workflows.”
- VPC Service Controls secures Batch From the official documentation: “Protect Batch resources and data by using VPC Service Controls.”
- VPC Service Controls secures Knowledge Catalog From the official documentation: “The API for Knowledge Catalog can be protected by VPC Service Controls and the product can be used normally inside service perimeters.”
- Backup and DR works with VPC Service Controls From the official documentation: “This page gives an overview of [VPC Service Controls](/vpc-service-controls) and how you can integrate it with Backup and DR to secure your data and resources.”
- BigQuery works with VPC Service Controls From the official documentation: “BigQuery integrates with VPC Service Controls to restrict access to your BigQuery resources from specific networks.”
- Cloud Logging works with VPC Service Controls From the official documentation: “This page describes how you can find VPC Service Controls errors using Cloud Logging.”
- Cloud Monitoring works with VPC Service Controls From the official documentation: “Cloud Monitoring performs the VPC perimeter check when a project is *added* to a metrics scope:”
- Cloud SQL works with VPC Service Controls From the official documentation: “Make sure that you configure VPC Service Controls so that the project that hosts the CA Service CA pool and CA<br>and the project that hosts Cloud SQL belong to the same service perimeter.”
- Knowledge Catalog works with VPC Service Controls From the official documentation: “The integration between Looker (Google Cloud core) and Knowledge Catalog supports VPC Service Controls.”
- VPC Service Controls secures Cloud Logging From the official documentation: “The API for Cloud Logging can be protected by VPC Service Controls and the product can be used normally inside service perimeters.”
- VPC Service Controls secures Cloud Monitoring From the official documentation: “VPC Service Controls provides additional security for Cloud Monitoring to help mitigate the risk of data exfiltration.”
- VPC Service Controls secures Cloud Run From the official documentation: “To learn more about the security features that Cloud Run provides, use the following resources: - [Access control with Identity and Access Management (IAM)](/run/docs/securing/managing-access) - [Per-service identity](/run/docs/securing/service-identity) - [Google Cloud Armor…”
- VPC Service Controls secures Firestore From the official documentation: “Secure Firestore with centralized Google Cloud governance encompassing Identity and Access Management,VPC Service Controls (VPC-SC), Access Transparency,<br>Access Approval, Cloud Monitoring, and Cloud Logging.”
- Firestore depends on Application Default Credentials From the official documentation: “To authenticate to Firestore, set up Application Default Credentials.”
- Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with Firestore From the official documentation: “To authenticate to Firestore, set up Application Default Credentials.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Cloud Run works with Cloud SQL From the official documentation: “Learn how to connect to Cloud SQL from Cloud Run”
- Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Knowledge Catalog depends on Application Default Credentials From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- BigQuery works with Knowledge Catalog From the official documentation: “Some Knowledge Catalog functionalities trigger job execution using BigQuery.”
- Cloud Logging works with customer-managed encryption keys From the official documentation: “To use Cloud Logging with Customer-managed encryption keys (CMEK), you must complete the steps in the [Enable CMEK for an organization](/logging/docs/routing/managed-encryption#enable) page in the Cloud Logging documentation.”
- Cloud SQL works with Cloud Storage From the official documentation: “When ingesting data from Cloud SQL, data is first staged to a Cloud Storage bucket.”
- BigQuery works with Cloud Monitoring From the official documentation: “You can use Monitoring to export your metrics to BigQuery.”
- Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
- Cloud Monitoring depends on Application Default Credentials From the official documentation: “To authenticate to Monitoring, set up Application Default Credentials.”
- Cloud Monitoring works with Cloud SQL From the official documentation: “You can also get more details by viewing the Cloud Monitoring logs for your Cloud SQL destination instance.”
- Cloud SQL works with Identity and Access Management From the official documentation: “This page describes how Cloud SQL is integrated with IAM .”
- Cloud SQL works with Knowledge Catalog From the official documentation: “You can use Knowledge Catalog to organize and enrich the metadata of Cloud SQL resources.”
- customer-managed encryption keys secures Cloud Storage From the official documentation: “CMEKs encrypt data at rest in Cloud SQL, Cloud Storage, and within GKE clusters.”
- Application Default Credentials secures Gemini Enterprise From the official documentation: “To authenticate to Gemini Enterprise, set up Application Default Credentials.”
- Batch depends on Application Default Credentials From the official documentation: “To authenticate to Batch, set up Application Default Credentials.”
- Cloud Logging works with Cloud SQL From the official documentation: “Cloud SQL uses Cloud Logging.”
- Cloud Logging works with Managed Service for Apache Airflow From the official documentation: “You can use [Cloud Monitoring](/monitoring/docs) and [Cloud Logging](/logging/docs) with Managed Service for Apache Airflow.”
- Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
- Cloud Storage works with Managed Service for Apache Airflow From the official documentation: “Managed Airflow associates a Cloud Storage bucket with your environment.”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- customer-managed encryption keys secures Cloud SQL From the official documentation: “Enable CMEK for Cloud SQL Databases”
- Identity and Access Management secures Firestore From the official documentation: “This page describes the IAM permissions and roles for Firestore.”
- Application Default Credentials secures Knowledge Catalog From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- BigQuery works with Cloud Audit Logs From the official documentation: “Cloud Audit Logs maintain a record of Google Cloud events, including BigQuery events.”
How learners score on this topic
Last updated