Cross-Perimeter Data Transfer in VPC Service Controls

PCSE By islever Editorial Last updated

Short answer

A Configure a perimeter bridge between the two service perimeters and explicitly specify the source and destination Cloud Storage buckets as the shared resources.

Question

Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter-B, in Google Cloud. You want to allow data to be copied from a Cloud Storage bucket in Perimeter-A to another Cloud Storage bucket in Perimeter-B. You must minimize exfiltration risk, only allow required connections, and follow the principle of least privilege. What should you do?
  1. Configure a perimeter bridge between Perimeter-A and Perimeter-B, and specify the Cloud Storage buckets as the resources involved. Correct Answer
  2. Configure a perimeter bridge between the projects hosting the Cloud Storage buckets in Perimeter-A and Perimeter-B.
  3. Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B.
  4. Configure a bidirectional egress/ingress rule for the Cloud Storage buckets in Perimeter-A and Perimeter-B.

Key Takeaways

Examines inter-perimeter connectivity mechanisms; the frequent trap involves misapplying standard ingress/egress policies instead of the dedicated cross-perimeter bridge feature.

This scenario evaluates secure data replication across isolated Google Cloud security boundaries. Community consensus and official architecture confirm that a perimeter bridge with explicitly scoped resources is the only compliant method.

Common mistake: Option C dominates incorrect votes because test-takers default to familiar ingress/egress syntax, failing to recognize that these rules govern single-perimeter access rather than boundary-crossing replication.

Expert Analysis

Why the Answer Is Correct

Google Cloud explicitly mandates perimeter bridges for any controlled data exchange between separate service perimeters. By defining the exact Cloud Storage buckets as participating resources, you enforce strict least-privilege access while maintaining full auditability. This directly satisfies the requirement to minimize exfiltration risk since only specified assets traverse the security boundary.

Why the Other Options Are Wrong

Option B incorrectly scopes the bridge to entire projects, violating least privilege by exposing all project resources unnecessarily. Options C and D apply ingress/egress rules, which are strictly designed for regulating access to restricted services or resources within a single perimeter, not for inter-perimeter replication. Bidirectional rules also fail to establish the necessary architectural bridge for cross-boundary traffic.

Community Comment Notes

Several high-voted comments correctly identify the perimeter bridge as the intended solution, noting its explicit support for cross-perimeter sharing [Comment 5]. Users referencing official documentation emphasize that bridges prevent broader exposure compared to blanket network rules [Comment 9]. The debate highlights how exam writers test precise terminology over generic firewall-style configurations [Comment 7].

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between intra-perimeter access controls and inter-perimeter connectivity when Google Cloud mentions multiple security perimeters. Look for keywords like “across perimeters” or “shared resources” to immediately trigger the perimeter bridge pattern during the exam.

Frequently Asked Questions

Why can't I use ingress/egress rules for cross-perimeter transfers?

Ingress and egress rules regulate access within a single perimeter or to external services. Cross-perimeter replication requires a dedicated perimeter bridge to maintain isolation boundaries.

Does specifying buckets in a perimeter bridge reduce exfiltration risk?

Yes, scoping the bridge to exact resources enforces least privilege. Only those buckets can transmit data across the security boundary, preventing unauthorized lateral movement.

More PCSE FAQ →

Community Votes

C
59%
A
41%

59% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. BB_norway 👍 4 Answered C
    It should be C, due to the offered granular control and principle of least priviledge
  2. d0fa7d5 👍 4 Answered A
    I think B is too broad in scope.
  3. jmaquino 👍 2 Answered C
    C: Data exchange between clients and resources separated by perimeters is secured by using ingress and egress rules. https://cloud.google.com/vpc-service-controls/docs/overview
  4. KLei 👍 2 Answered C
    "minimize exfiltration risk, only allow required connections, and follow the principle of least privilege" - C follow the principle of least privilege
  5. MoAk 👍 2 Answered A
    Looks like this chat has been infiltrated. Clearly the correct answer is A. this exact feature exists for this use case.
Show 7 more comments
  1. nah99 👍 2 Answered C
    https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules
  2. BPzen 👍 1 Answered A
    To enable data transfer between two VPC Service Controls service perimeters while minimizing exfiltration risk and adhering to the principle of least privilege, you need to use a perimeter bridge. This bridge allows controlled communication between the two perimeters but must be configured to include only the specific resources (in this case, the Cloud Storage buckets). Here's why the other options are less suitable: A perimeter bridge between projects is overly broad and does not align with the principle of least privilege. It would allow communication for all resources in the projects, increasing the risk of exfiltration. C. Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B. VPC Service Controls do not directly support simple egress/ingress rules between perimeters. Perimeter bridges are the designed mechanism for controlled inter-perimeter communication.
  3. cachopo 👍 1 Answered A
    A perimeter bridge allows limited communication between resources in two service perimeters. By explicitly specifying the Cloud Storage buckets involved, you restrict the scope of the bridge to only the required resources. While egress and ingress rules control data flow, they are typically used for access to services outside the perimeters, not between two perimeters. Additionally, this approach lacks granularity and risks unintended exposure.
  4. YourFriendlyNeighborhoodSpider 👍 1 Answered C
    "minimize exfiltration risk, only allow required connections, and follow the principle of least privilege" - C follow the principle of least privilege While a perimeter bridge allows communication between two service perimeters, it may grant broader access than necessary and does not adhere to the principle of least privilege, as it could expose resources to more connections than intended.
  5. Pime13 👍 1 Answered A
    https://cloud.google.com/vpc-service-controls/docs/share-across-perimeters#example_of_perimeter_bridges
  6. BondleB 👍 2 Answered C
    C
  7. yokoyan 👍 1 Answered B
    I think it's B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide