Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise is designing a Cardholder Data Environment (CDE) on Google Cloud to meet stringent PCI-DSS and FedRAMP network segmentation and perimeter defense mandates. The architecture deploys a Shared VPC host project for centralized network management alongside multiple service projects hosting compute workloads, Cloud Build private pools, and Cloud Storage buckets containing sensitive cardholder data.
Which architectural requirement must be implemented to enforce the VPC Service Controls boundary across this infrastructure without breaking communication?
This option attempts to attach VPC Service Controls directly to individual subnetworks within a VPC and rely on hierarchical firewall policies to block unauthorized egress traffic to Google APIs.
The requirement was to enforce Layer 3/Layer 4 egress filtering across folders in the resource hierarchy rather than preventing Google Cloud API-level data exfiltration.
This approach creates isolated perimeters for each separate service project and attempts to link the networks together using VPC Network Peering to facilitate inter-service and API communication.
Two entirely separate business units with isolated VPC networks needed private RFC 1918 connectivity without sharing common managed service resources or a Shared VPC infrastructure.
VPC Service Controls allows enterprises to establish a secure, logical boundary around Google-managed resources and APIs to mitigate data exfiltration risks. When paired with a Shared VPC architecture, VPC Service Controls perimeter configuration requires that both the host project (which provides the underlying network infrastructure and subnets) and all attached service projects (which host the compute instances and application resources) reside within the exact same service perimeter.
storage.googleapis.com and cloudbuild.googleapis.com ensures that only authorized identities and networks inside the perimeter can access those service endpoints.Placing both the host project and service projects inside the same service perimeter aligns with Google Cloud security best practices for Shared VPC and prevents broken cross-project API routing, ensuring uninterrupted compliance enforcement.
This approach attempts to enforce VPC Service Controls perimeter isolation exclusively on the service projects hosting application workloads while leaving the Shared VPC host project outside the perimeter, relying on Private Google Access to route traffic to Google APIs.
The host project contained no Google API-accessible resources and Google Cloud supported perimeters that decoupled subnet network ownership from workload project membership.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated