Which GCP Products Authorize Outbound Traffic for PCI DSS

PCSE By islever Editorial Last updated

Configuring boundary segmentation. Designing and configuring perimeter security.

Short answer

CD Use Compute Engine and GKE, where native VPC egress firewall rules authorize outbound traffic without compensating controls, unlike App Engine and Cloud Functions.

Question

In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
  1. App Engine
  2. Cloud Functions
  3. Compute Engine Correct Answer
  4. Google Kubernetes Engine Correct Answer
  5. Cloud Storage

Key Takeaways

The trap is equating managed serverless infrastructure with controlled egress; PCI DSS authorization must be a native product feature, not an add-on compensating control.

This PCI DSS question tests which Google Cloud products can natively authorize all outbound traffic. Compute Engine and GKE (C, D) satisfy it using built-in VPC egress firewall rules, while App Engine and Cloud Functions require compensating controls.

Common mistake: Choosing A and B because App Engine and Cloud Functions are fully managed and assumed to restrict outbound traffic — in fact App Engine offers only ingress rules and both require compensating controls for PCI DSS egress authorization.

Expert Analysis

What the question is really asking The key phrase is "without additional compensating controls." PCI DSS Requirements 1.2.1 and 1.3.4 demand that all inbound and outbound traffic be explicitly authorized and that everything else be denied. The question therefore asks which Google Cloud offerings can enforce egress authorization natively, as a first-class feature of the product, rather than needing an extra layer bolted on.

Why the serverless pair is the trap App Engine and Cloud Functions look attractive because they are fully managed: Google runs the sandbox, and there is no VPC firewall for you to misconfigure. Many test-takers reason that "managed equals controlled outbound traffic." One comment argues that App Engine "now supports egress controls," so option A should count. That reasoning fails on the exact wording: App Engine's firewall rules are ingress-only — they apply solely to traffic routed to your app — and no egress rules exist for it. Because App Engine egress cannot be restricted, a merchant must supply a compensating control (such as a third-party proxy or an external egress gateway) or switch products. Cloud Functions has the same structural gap in the classic PCI guidance. So A and B satisfy only part of the requirement and fail the "without additional compensating controls" clause.

Why C and D are correct Both Compute Engine (option C) and Google Kubernetes Engine (option D) run on your VPC, where you configure native egress (allow/deny) firewall rules — and for GKE, Gateway API policy or hierarchical firewall policies. These are normal, built-in product capabilities, not compensating measures. Google's PCI DSS guidance for Cloud explicitly names Compute Engine and GKE as the preferred alternatives when App Engine egress cannot be restricted. The heaviest-voted community analysis agrees, quoting the PCI guidance's statement that App Engine egress rules are not available and that Compute Engine and GKE are recommended. Cloud Storage (option E) is not a compute platform with authorized outbound traffic flows at all.

Verdict: options C and D.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On Google Cloud security questions, always check whether a control is native to the product or an add-on: PCI and similar compliance questions hinge on that distinction. Eliminate options where the vendor documentation explicitly states a limitation (here, App Engine egress rules do not exist) and where the option would require a proxy, gateway, or third-party appliance. Then pair the two products that enforce the control through standard, first-class configuration.

Frequently Asked Questions

Why don't App Engine and Cloud Functions satisfy PCI DSS egress authorization?

App Engine's built-in firewall applies only to inbound (ingress) traffic and has no egress rules, and Cloud Functions similarly cannot restrict outbound connections natively. Both would need a proxy or gateway, which counts as a compensating control.

How do Compute Engine and GKE authorize outbound traffic?

Both run in your VPC, where you define native egress allow/deny firewall rules; GKE can also use Gateway API or hierarchical firewall policies. These are standard product features, not compensating controls.

What is a compensating control in PCI DSS?

A compensating control is an alternative safeguard used when a requirement cannot be met directly with the product's native capabilities, such as routing App Engine egress through a third-party proxy to enforce outbound authorization.

More PCSE FAQ →

Discussion 29 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 29

  1. KILLMAD 👍 18
    Answer is CD because the doc mentions the following: "App Engine ingress firewall rules are available, but egress rules are not currently available:" and "Compute Engine and GKE are the preferred alternatives."
  2. rafaelc 👍 7
    It is CD. App Engine ingress firewall rules are available, but egress rules are not currently available. Per requirements 1.2.1 and 1.3.4, you must ensure that all outbound traffic is authorized. SAQ A-EP and SAQ D–type merchants must provide compensating controls or use a different Google Cloud product. Compute Engine and GKE are the preferred alternatives. https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
  3. deony 👍 4
    IMO, this question was posted in 2020. and later, Google released egress control for serverless VPC. so currently App engine also are compliant in PCI. I think this question is outdated
  4. GCParchitect2022 👍 4
    Document updated. AD "App Engine ingress firewall rules and egress traffic controls" https://cloud.google.com/architecture/pci-dss-compliance-in-gcp#product_guidance
  5. BPzen 👍 3
    PCI DSS (Payment Card Industry Data Security Standard) requires strict control over outbound traffic, meaning that only explicitly authorized traffic is allowed to leave the environment. Both App Engine and Cloud Functions are fully managed serverless platforms where Google handles the network configuration, including restrictions on outbound connections. Outbound traffic in these environments can be controlled without additional compensating controls because Google ensures compliance by managing the network restrictions and underlying infrastructure.
Show 24 more comments
  1. techdsmart 👍 3
    AB With App Engine, you can ingress firewall rules and egress traffic controls . You can use Cloud Functions ingress and egress network settings. AB makes sense if we are talking about controlling ingress and egress traffic
  2. Littleivy 👍 3
    Answer is CD For App Engine, the App Engine firewall only applies to incoming traffic routed to your app or service. https://cloud.google.com/appengine/docs/flexible/understanding-firewalls
  3. bfeda11 👍 2
    The correct answer i C and D - I checked that both in Gemini and ChatGPT. Why? It is because in Compute Engine and GKE it is you who manage VPC Firewall rules and it is not compensating control - it is a normal feature you manage. In App Engine and Cloud Functions you do not manage VPC firewall rules and these services are by default open to the Internet (public). If you want to make it more secure, you need to implement non-default solutions like VPC Connector or Cloud Armor and since they are not part of a default configuration, they are compensating controls.
  4. Kiroo 👍 2
    Today this question does not have an specific answer it seems that compute engine and gke wound need additional steps to setup and functions and app engine it’s possible to just set egress so I would go with this pair
  5. Brosh 👍 2
    hey. can anyone explain why isn't A correct? the decumantion mentions app engine as an option but not compute engine https://cloud.google.com/architecture/pci-dss-compliance-in-gcp
  6. anonymousoutsider00 👍 2
    >> The official reference URLs https://docs.cloud.google.com/architecture/pci-dss-compliance-in-gcp Correct Answers are C and D
  7. EvaGao 👍 2
    based on the Gemini
  8. ArizonaClassics 👍 2
    CD best option
  9. jordi_194 👍 2
    Ans: CD
  10. rafpol 👍 1
    Answer is AB, . App Engine Standard Environment Provides built-in network restrictions and outbound traffic controls Only allows connections to specific Google services and approved external APIs Inherent sandboxing limits outbound connectivity by default No need for additional firewall rules or network policies 2. Cloud Functions Runs in a fully managed environment with built-in network restrictions Limited outbound connectivity by default through Google's managed infrastructure Automatic isolation and controlled networking without customer configuration Built-in restrictions on what external services can be accessed
  11. civilizador 👍 1
    Answer is CD: https://cloud.google.com/architecture/pci-dss-compliance-in-gcp#securing_your_network Securing your network To secure inbound and outbound traffic to and from your payment-processing app network, you need to create the following: Compute Engine firewall rules A Compute Engine virtual private network (VPN) tunnel A Compute Engine HTTPS load balancer For creating your VPC, we recommend Cloud NAT for an additional layer of network security. There are many powerful options available to secure networks of both Compute Engine and GKE instances.
  12. luamail78 👍 1
    While the older answers (CD) were correct based on previous limitations, App Engine now supports egress controls.This means you can configure rules to manage outbound traffic, making it suitable for meeting PCI DSS requirements without needing extra compensating controls.
  13. rottzy 👍 1
    have a look 👀 at https://cloud.google.com/security/compliance/pci-dss#:~:text=The%20scope%20of%20the%20PCI,products%20against%20the%20PCI%20DSS. there are multiple answers!
  14. daniloge 👍 1
    With Compute Engine and GKE you can manage VPC firewall rules. App Engine, Cloud Functions and Cloud Storage you do not manage firewall rules
  15. GCBC 👍 1
    Ans is CD as per google docs - https://cloud.google.com/architecture/pci-dss-compliance-in-gcp#securing_your_network
  16. deony 👍 1
    https://cloud.google.com/blog/products/serverless/app-engine-egress-controls-and-user-managed-service-accounts?hl=en
  17. saurabh1805 👍 1
    C & D is correct answer here. https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
  18. standm 👍 1
    CD - since both support Egress firewalls.
  19. MohitA 👍 1
    CD serves the purpose for sure
  20. GCP72 👍 1
    The correct answer is CD
  21. mahi9 👍 1
    The most viable options
  22. CHECK666 👍 1
    CD is the answer.
  23. AzureDP900 👍 1
    CD is right
  24. DebasishLowes 👍 1
    Ans : CD

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide