Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise is deploying confidential workloads onto Compute Engine instances within a custom VPC subnet that has no external IP addresses and no default internet gateway route. The security team has defined a VPC Service Controls (VPC-SC) perimeter protecting services such as Cloud Storage and BigQuery.
To enforce strict perimeter boundaries and prevent data exfiltration, the architecture must satisfy these criteria:
Which network and DNS configuration should the security engineer implement?
The restricted.googleapis.com virtual IP (VIP) address range (199.36.153.4/30 for IPv4) is a specialized Google Cloud endpoint designed specifically to integrate with VPC Service Controls. When workloads route API traffic to this VIP, Google Cloud only accepts API calls directed to services that support VPC Service Controls perimeters.
StudyCerts
StudyCertsrestricted.googleapis.com automatically drops or rejects requests targeting Google services that do not support VPC Service Controls. This prevents workloads from exfiltrating data via unvetted, non-perimeter-protected APIs.googleapis.com with a wildcard CNAME to restricted.googleapis.com ensures that all VM API calls natively resolve to 199.36.153.4/30.Routing to restricted.googleapis.com is the Google Cloud best practice for environments governed by VPC Service Controls. It ensures that traffic cannot bypass perimeter security boundaries while keeping network traffic entirely private.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.