Answer-first summary for fast verification
Answer: Configure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages.
The correct answer is A because Project B is explicitly stated to not be in a VPC Service Controls perimeter. An ingress policy allows controlled access from outside the perimeter to specific resources within the perimeter, which aligns with the principle of least privilege by granting access only to the required service account from Project B. Option C (perimeter bridge) is incorrect because bridges only work between two service perimeters, and Project B is not in a perimeter. Option B (access level) is less suitable as it typically applies to broader access controls like IP ranges or user-based conditions, not service account-specific access across perimeters. Option D (removing Pub/Sub from restricted services) would overly broaden access, violating least privilege. The community discussion strongly supports A, with multiple comments highlighting that Project B's lack of a perimeter makes C invalid and A's precision with ingress policies adheres to least privilege.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
You manage a Google Cloud project (Project A) that is protected by a VPC Service Controls perimeter, which is currently blocking all API access, including Pub/Sub. A service account from a different, unprotected project (Project B) needs to consume messages from a Pub/Sub topic in Project A. You must grant this access following the principle of least privilege.
What should you do?
A
Configure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages.
B
Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
C
Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
D
Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.