GCP Professional Cloud Security Engineer Practice Question

Your security team has enclosed two sensitive finance projects in a VPC Service Controls perimeter called finance-perimeter. Internal staff already access them through an existing high-trust access level. You must now let external consultants, who authenticate as members of the group [email protected], deploy and manage Cloud Run in those projects only between 09:00 and 17:00 UTC. Consultants must remain blocked from BigQuery, Cloud Storage, and every other Google Cloud API inside the perimeter. What should you do?

Add the [email protected] group as members of finance-perimeter and create a bridge perimeter that links a new consultants project, relying on IAM roles to limit them to Cloud Run.
Define a custom access level that requires membership in [email protected] and a request.time between 09:00 and 17:00 UTC, then add an ingress rule to finance-perimeter that allows only run.googleapis.com when this access level is matched.
Reuse the existing high-trust access level and add an egress rule on finance-perimeter that permits run.googleapis.com; leave other services unmodified.
Grant the consultants group the Cloud Run Admin role on the finance projects without changing the service perimeter, because IAM permissions override VPC Service Controls.

Report Issue

Answer Description

Create a dedicated, least-privilege access path for the consultants. A custom Access Context Manager access level can restrict requests to principals in the [email protected] group and check request.time to enforce the 09:00-17:00 UTC window. Attaching that access level to an ingress policy on finance-perimeter that lists only run.googleapis.com means that matching requests from outside the perimeter are forwarded solely to the Cloud Run Admin API, while all other Google APIs (such as BigQuery and Cloud Storage) remain protected by the perimeter's default deny behavior. Adding the group as perimeter members, using a bridge perimeter, changing egress rules, or relying on IAM alone would either over-grant access or fail to bypass the perimeter.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.