Exam Professional Cloud Database Engineer topic 1 question 91 discussion

B While IAM enables granular identity-based access control, VPC Service Controls enables broader context-based perimeter security, including controlling data egress across the perimeter. We recommend using both VPC Service Controls and IAM for defense in depth. https://cloud.google.com/vpc-service-controls/docs/overview#how-vpc-service-controls-works

B. A is wrong because you might have the right credentials but still access Bigtable across the internet. Same is true for C. Cloud Armor could help, but VPC Service Controls is a classic use case of ensuring access is only from within certain VPC networks. From Google’s documentation, “Users can define a security perimeter around Google Cloud resources such as Cloud Storage buckets, Bigtable instances, and BigQuery datasets to constrain data within a VPC and control the flow of data.” https://cloud.google.com/vpc-service-controls

I'll go for B

B: Use VPC Service Controls to create a trusted network for the Bigtable service.