How to restrict VPC Service Controls to a specific folder?

PCSE By islever Editorial Last updated

Short answer

C Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.”

Question

You manage a Google Cloud organization with many projects located in various regions around the world. The projects are protected by the same Access Context Manager access policy. You created a new folder that will host two projects that process protected health information (PHI) for US-based customers. The two projects will be separately managed and require stricter protections. You are setting up the VPC Service Controls configuration for the new folder. You must ensure that only US-based personnel can access these projects and restrict Google Cloud API access to only BigQuery and Cloud Storage within these projects. What should you do?
  1. Create a scoped access policy, add the new folder under “Select resources to include in the policy,” and assign an administrator under “Manage principals.”
  2. Enable Identity Aware Proxy in the new projects.
  3. Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.” Correct Answer
  4. Configure a Cloud Interconnect connection or a Virtual Private Network (VPN) between the on-premises environment and the Google Cloud organization.

Key Takeaways

This question tests the configuration of VPC Service Controls perimeters within an Access Context Manager policy

To enforce stricter access controls like geographic restrictions and limited API access for specific projects

Common mistake: Choosing A (creating a scoped access policy) is a common error because test-takers confuse delegation needs with the fundamental requirement of applying service perimeters for security restrictions.

Expert Analysis

Why the Answer Is Correct

Option C is correct because VPC Service Controls are configured within an Access Context Manager access policy. By editing the organization-level policy, you can create a new service perimeter or modify an existing one to specifically include the new folder. This allows you to apply the required US-based IP restrictions and limit API access to only BigQuery and Cloud Storage without impacting the configuration of other projects outside this perimeter.

Why the Other Options Are Wrong

Option A is incorrect because creating a scoped access policy is primarily for delegating administration, not strictly necessary for applying VPC Service Controls security rules. Option B is incorrect because Identity Aware Proxy (IAP) manages access to web apps and VMs, not the broad API access restrictions required for BigQuery and Cloud Storage. Option D is incorrect because Cloud Interconnect or VPN provides network connectivity but does not enforce the specific API access or geographic personnel restrictions mandated by the scenario.

Community Comment Notes

The community strongly supports Option C, noting that editing the policy allows for the creation of a specific security boundary (service perimeter) around the PHI data. Commenters clarified that adding the folder to the policy does not automatically affect other projects, addressing the misconception raised in Comment [2]. The consensus is that the organization-level policy is the correct place to define these perimeters for centralized control.

Official Reference

https://cloud.google.com/vpc-service-controls/docs/overview

This link opens the official vendor documentation in a new tab.

Exam Strategy

Remember that "editing the access policy" in the context of VPC Service Controls usually means defining or modifying a service perimeter within that policy

Community Votes

C
83%
A
17%

83% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. siheom 👍 3 Answered C
    The best solution to meet the requirements of restricting access to US-based personnel and limiting Google Cloud API access to only BigQuery and Cloud Storage for the two new projects processing PHI is C.
  2. vamgcp 👍 1 Answered C
    Edits the Organization-Level Access Policy: This ensures that the stricter access controls, including the geographic location restriction, are applied to the new folder and its projects while maintaining the existing policy for other projects in the organization. Service Perimeter: Defining the service perimeter specifically for the two new projects creates a security boundary around the PHI data, preventing data exfiltration. Restricting Services: Limiting access to only BigQuery and Cloud Storage minimizes the potential attack surface and reduces the risk of unauthorized data access to other services. Geographic Location Condition: By adding the "Geographic locations" condition to the existing access level, you ensure that only users accessing the resources from within the US are granted access, meeting the requirement for US-based personnel access.
  3. abdelrahman89 👍 1
    C - Centralized Access Control: Editing the organization-level access policy ensures consistency and reduces the management overhead compared to creating a separate scoped policy. VPC Service Controls for Isolation: Defining the new projects as "Resources to protect" isolates them within the service perimeter. Restricting services to "all services" and then allowing only BigQuery and Cloud Storage provides granular control over API access. Geographic Location Restriction: Adding a "Geographic locations" condition set to "US" in the existing access level ensures that only users accessing from US locations can utilize the access policy and access these resources.
  4. JohnDohertyDoe 👍 1 Answered A
    Editing the existing policy would affect all the projects (question clearly states there are projects all around the world). While A does not cover the US restriction, it seems to be the best answer.
  5. nah99 👍 1
    Yep, and they mention there being projects located around the world
Show 2 more comments
  1. MoAk 👍 1 Answered C
    Only one that restricts access to US personnel
  2. kalbd2212 👍 1
    going with A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide