An enterprise maintains two distinct regular VPC Service Controls perimeters: Perimeter-A for core internal workloads and Perimeter-B for departmental data storage. A centralized processing workload in a project within Perimeter-A requires bidirectional API communication and data exchange with Cloud Storage buckets located in a project protected by Perimeter-B. The organization's governance rules prohibit merging the perimeters or modifying the projects assigned to each perimeter boundary. Which solution should the security engineer implement to enable communication between the two projects?

Create a perimeter bridge that includes the specific project from Perimeter-A and the specific project from Perimeter-B.: What a Perimeter Bridge Is A perimeter bridge in Access Context Manager allows projects enclosed in distinct regular service perimeters to communicate and share protected Google Cloud resources without merging or altering the membership of the underlying perimeters. How It Meets the Requirements Cross-perimeter communication: A perimeter bridge links the project in Perimeter-A and the project in Perimeter-B, allowing services within those specific projects to exchange data directly while keeping perimeter boundaries intact. Maintains existing regular perimeters: Because a project can be a member of only one regular service perimeter, a bridge provides a mechanism to establish trusted communication across boundaries without reassigning or merging project memberships. Strict boundary enforcement: Unrelated projects inside Perimeter-A and Perimeter-B that are not listed in the bridge cannot access each other, preserving isolation across security zones. Key Advantages and Capabilities Project-level linking: Bridges connect specific projects rather than exposing all projects in both perimeters. Preserves separation of concerns: Allows different organizational units or tiers to retain distinct security policies and restricted service lists. No data exfiltration bypass: Communication remains strictly bounded to the projects explicitly defined within the bridge. Why This Is Optimal Perimeter bridges allow targeted inter-perimeter access without violating the architectural rule that a project can belong to only one regular perimeter, and without exposing the rest of either perimeter's projects to unnecessary lateral communication.

Vpc Service Controls Regular Vs Bridge Perimeter | Professional Cloud Security Engineer

StudyCerts

Explanations

What a Perimeter Bridge Is

A perimeter bridge in Access Context Manager allows projects enclosed in distinct regular service perimeters to communicate and share protected Google Cloud resources without merging or altering the membership of the underlying perimeters.

How It Meets the Requirements

Cross-perimeter communication: A perimeter bridge links the project in Perimeter-A and the project in Perimeter-B, allowing services within those specific projects to exchange data directly while keeping perimeter boundaries intact.
Maintains existing regular perimeters: Because a project can be a member of only one regular service perimeter, a bridge provides a mechanism to establish trusted communication across boundaries without reassigning or merging project memberships.
Strict boundary enforcement: Unrelated projects inside Perimeter-A and Perimeter-B that are not listed in the bridge cannot access each other, preserving isolation across security zones.

Key Advantages and Capabilities

Project-level linking: Bridges connect specific projects rather than exposing all projects in both perimeters.
Preserves separation of concerns: Allows different organizational units or tiers to retain distinct security policies and restricted service lists.
No data exfiltration bypass: Communication remains strictly bounded to the projects explicitly defined within the bridge.

Why This Is Optimal

Perimeter bridges allow targeted inter-perimeter access without violating the architectural rule that a project can belong to only one regular perimeter, and without exposing the rest of either perimeter's projects to unnecessary lateral communication.

View source documentation

Professional Cloud Security Engineer

Vpc Service Controls Regular Vs Bridge Perimeter