GCP Professional Cloud Architect Practice Question 6: VPC Service Controls Exfiltration
Google Cloud Professional Cloud Architect · Test 1 · question 6 of 10
A data protection review at a health insurer flags a residual risk that IAM alone does not cover: an analyst who legitimately holds BigQuery Data Viewer on the claims dataset could run a query from an unmanaged laptop and copy the results into a personal Google Cloud project, or a leaked service account key could be used to read the data from outside the corporate network. Roles are already scoped to the minimum, and the analytics projects hold no VMs with external IP addresses. One approved partner project outside the analytics environment must keep receiving an exported extract.
Which control addresses the flagged risk?
Show answer and explanation
Answer:
VPC Service Controls draws a context-based boundary around Google-managed services and is designed for precisely these threats: stolen credentials, malicious insiders, and misconfigured IAM policies. Because the perimeter is evaluated on every API call regardless of who the caller is, a valid Data Viewer credential used from outside the allowed context is refused, and copying data into a project outside the perimeter is blocked as egress. Access levels re-admit trusted context such as the corporate network or managed devices, and an explicit egress rule carves out the one approved partner project, so the exception is declared and auditable rather than a hole. Google's guidance is to use IAM and VPC Service Controls together as defence in depth, not as alternatives.
Option A misunderstands what the flagged risk is. External IP and firewall controls govern the network path of VMs; BigQuery is accessed through a Google API endpoint, and an analyst on a laptop is not sending packets from a VM in those projects at all. There is nothing here for a firewall rule to stop.
Option B protects data at rest and tidies up bucket permissions, but neither changes who may read the data through the API. An analyst authorized to query the dataset is served decrypted results regardless of whether the key is customer-managed.
Option D improves credential hygiene and is worth doing, but it does not constrain *where* the short-lived credential may be used or *where* the results may go. The insider in the scenario is authorized; the missing control is a boundary on context and egress, not on credential lifetime.
Reference: VPC Service Controls overview