How to restrict VPC Service Controls to a specific folder?

VPC Service Controls

Answer Correct answer: C — Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.”

You manage a Google Cloud organization with many projects located in various regions around the world. The projects are protected by the same Access Context Manager access policy. You created a new folder that will host two projects that process protected health information (PHI) for US-based customers. The two projects will be separately managed and require stricter protections. You are setting up the VPC Service Controls configuration for the new folder. You must ensure that only US-based personnel can access these projects and restrict Google Cloud API access to only BigQuery and Cloud Storage within these projects. What should you do?

Create a scoped access policy, add the new folder under “Select resources to include in the policy,” and assign an administrator under “Manage principals.”
Enable Identity Aware Proxy in the new projects.
Edit the organization-level access policy and add the new folder under “Select resources to include in the policy.” Correct Answer
Configure a Cloud Interconnect connection or a Virtual Private Network (VPN) between the on-premises environment and the Google Cloud organization.

vpc service controls phi access context manager configuration google cloud us-only access restrict api access bigquery

Community Votes

83%

17%

83% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the configuration of VPC Service Controls perimeters within an Access Context Manager policy

To enforce stricter access controls like geographic restrictions and limited API access for specific projects

Choosing A (creating a scoped access policy) is a common error because test-takers confuse delegation needs with the fundamental requirement of applying service perimeters for security restrictions.

Community Discussion (7 comments)

JohnDohertyDoe 👍 1 Selected: A

Editing the existing policy would affect all the projects (question clearly states there are projects all around the world). While A does not cover the US restriction, it seems to be the best answer.

MoAk 👍 1 Selected: C

Only one that restricts access to US personnel

vamgcp 👍 1 Selected: C

Edits the Organization-Level Access Policy: This ensures that the stricter access controls, including the geographic location restriction, are applied to the new folder and its projects while maintaining the existing policy for other projects in the organization. Service Perimeter: Defining the service perimeter specifically for the two new projects creates a security boundary around the PHI data, preventing data exfiltration. Restricting Services: Limiting access to only BigQuery and Cloud Storage minimizes the potential attack surface and reduces the risk of unauthorized data access to other services. Geographic Location Condition: By adding the "Geographic locations" condition to the existing access level, you ensure that only users accessing the resources from within the US are granted access, meeting the requirement for US-based personnel access.

kalbd2212 👍 1

going with A

nah99 👍 1

Yep, and they mention there being projects located around the world

siheom 👍 3 Selected: C

The best solution to meet the requirements of restricting access to US-based personnel and limiting Google Cloud API access to only BigQuery and Cloud Storage for the two new projects processing PHI is C.

abdelrahman89 👍 1

C - Centralized Access Control: Editing the organization-level access policy ensures consistency and reduces the management overhead compared to creating a separate scoped policy. VPC Service Controls for Isolation: Defining the new projects as "Resources to protect" isolates them within the service perimeter. Restricting services to "all services" and then allowing only BigQuery and Cloud Storage provides granular control over API access. Geographic Location Restriction: Adding a "Geographic locations" condition set to "US" in the existing access level ensures that only users accessing from US locations can utilize the access policy and access these resources.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option C is correct because VPC Service Controls are configured within an Access Context Manager access policy. By editing the organization-level policy, you can create a new service perimeter or modify an existing one to specifically include the new folder. This allows you to apply the required US-based IP restrictions and limit API access to only BigQuery and Cloud Storage without impacting the configuration of other projects outside this perimeter.

Why the Other Options Are Wrong

Option A is incorrect because creating a scoped access policy is primarily for delegating administration, not strictly necessary for applying VPC Service Controls security rules. Option B is incorrect because Identity Aware Proxy (IAP) manages access to web apps and VMs, not the broad API access restrictions required for BigQuery and Cloud Storage. Option D is incorrect because Cloud Interconnect or VPN provides network connectivity but does not enforce the specific API access or geographic personnel restrictions mandated by the scenario.

Community Comment Notes

The community strongly supports Option C, noting that editing the policy allows for the creation of a specific security boundary (service perimeter) around the PHI data. Commenters clarified that adding the folder to the policy does not automatically affect other projects, addressing the misconception raised in Comment [2]. The consensus is that the organization-level policy is the correct place to define these perimeters for centralized control.

Official Reference

Exam Strategy

Remember that "editing the access policy" in the context of VPC Service Controls usually means defining or modifying a service perimeter within that policy

Related Analysis

← Back to PCSE Study Guide