How to Securely Isolate an Externally-Facing App in Google Cloud?

Cloud Security Architecture & Identity Management

Answer Correct answer: D — Create a new project for the application, and use VPC Network Peering to access necessary resources in the internal projects.

You manage multiple internal-only applications that are hosted within different Google Cloud projects. You are deploying a new application that requires external internet access. To maintain security, you want to clearly separate this new application from internal systems. Your solution must have effective security isolation for the new externally-facing application. What should you do?

Deploy the application within the same project as an internal application. Use a Shared VPC model to manage network configurations.
Place the application in the same project as an existing internal application, and adjust firewall rules to allow external traffic.
Create a VPC Service Controls perimeter, and place the new application’s project within that perimeter.
Create a new project for the application, and use VPC Network Peering to access necessary resources in the internal projects. Correct Answer

google cloud workload isolation vpc network peering vs vpc service controls pcse exam study guide google cloud project boundaries

Community Votes

62%

38%

62% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests workload isolation strategies; the common trap is confusing VPC Service Controls (data exfiltration guardrails) with project-level architectural boundaries.

This question tests how to achieve strong administrative and network isolation for a new public-facing workload in Google Cloud. The page establishes that provisioning a dedicated project combined with VPC peering provides the clearest security boundary.

Candidates often select VPC Service Controls (C) assuming perimeter services handle all isolation, but they only restrict data flow to authorized networks rather than providing administrative or network segmentation.

Community Discussion (8 comments)

YourFriendlyNeighborhoodSpider 👍 1 Selected: D

Answer is D, because that way you have complete isolation as required in the question. Explanation for C: C. Use VPC Service Controls (VPC-SC) is useful for protecting data from being exfiltrated, but it does not isolate an externally-facing app from internal systems. It is more suited for controlling access to sensitive APIs and services, not for network-level isolation.

p981pa123 👍 1 Selected: C

You need stronger security and isolation for the externally-facing application and want to prevent unintended data access or leakage.

LaxmanTiwari 👍 2 Selected: D

Agree with Pime13

Pime13 👍 2 Selected: D

Option C suggests creating a VPC Service Controls perimeter and placing the new application’s project within that perimeter. While VPC Service Controls can enhance security by defining a security perimeter around Google Cloud resources, it is primarily designed to protect data from being exfiltrated to unauthorized networks or users. It does not inherently provide the level of isolation needed for an externally-facing application. Creating a new project (Option D) ensures complete separation of resources, IAM policies, and network configurations, which is crucial for maintaining security isolation between internal and external applications. This approach minimizes the risk of accidental exposure of internal resources to the internet.

vamgcp 👍 2 Selected: D

While VPC Service Controls offer strong isolation, they might be overkill for this scenario involving internal applications with moderate security needs.

f36bdb5 👍 4 Selected: C

It does not say anywhere that the external application should access internal resources. VPC peering would then be a massive security risk

json4u 👍 1 Selected: D

It's D

abdelrahman89 👍 1

D - Dedicated Project: Creating a new project for the externally-facing application provides a clear separation from internal systems, reducing the risk of unauthorized access or lateral movement. VPC Network Peering: Using VPC Network Peering allows the new project to access resources in the internal projects, while maintaining a controlled and secure boundary. This ensures that external traffic cannot directly access internal resources without going through the established peering connection. Improved Security: This approach offers enhanced security by minimizing the attack surface and limiting the potential impact of a breach.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Creating a new project establishes a distinct administrative boundary, which is Google Cloud’s foundational method for isolating workloads and applying least-privilege IAM policies. Using VPC Network Peering then enables controlled, secure connectivity to internal resources without merging network spaces or sharing project configurations. This architecture directly satisfies the requirement for clear separation and effective security isolation.

Why the Other Options Are Wrong

Options A and B retain the workload in an existing project, which violates the explicit requirement for clear separation and increases lateral movement risks. Option C misapplies VPC Service Controls, which are designed to prevent data exfiltration across service perimeters rather than isolate externally-facing compute from internal network segments.

Community Comment Notes

As one contributor observed, "keeping the workload in the same project creates unnecessary exposure", reinforcing that shared environments undermine isolation goals. Several learners confirmed that VPC-SC focuses on API/data protection rather than network segregation, while others emphasized that a dedicated project inherently reduces unauthorized access risk while peering maintains necessary but bounded connectivity.

Official Reference

Exam Strategy

Always prioritize Google Cloud projects as your first-line security and administrative boundary when questions emphasize workload separation or least privilege. Reserve VPC Service Controls for data loss prevention scenarios rather than general network or project isolation.

Frequently Asked Questions

Why is VPC Service Controls incorrect for network isolation?

VPC-SC enforces data exfiltration guardrails at the service perimeter level but does not segment networks or replace project boundaries for workload isolation.

Does VPC peering violate security isolation requirements?

No, peering creates a private, non-routable link between VPCs without merging CIDR blocks or granting broad project-level access, maintaining strict boundaries.

Related Analysis

← Back to PCSE Study Guide