PCSE BeyondCorp & VPC Service Controls (2026)

A deep dive into the zero-trust domain of the PCSE exam. This article organizes BeyondCorp Enterprise (Chrome Enterprise Premium), Identity-Aware Proxy (IAP), Context-Aware Access, Endpoint Verification, and VPC Service Controls into one coherent picture.

BeyondCorp Enterprise (Chrome Enterprise Premium)

The productized version of BeyondCorp, Google's internal zero-trust implementation. Premise: throw out the idea that "inside the network = safe" and decide access based on device, user, and context.

Key components

Identity-Aware Proxy (IAP): An authentication gateway placed in front of the HTTPS load balancer
Endpoint Verification: Chrome extension plus native agents that collect device posture (encryption, OS, patch level)
Context-Aware Access: Fine-grained control via Access Levels (device + IP + geography + time)
Threat / DLP Protection: Phishing and data-exfiltration defenses at the browser layer
Access Context Manager: Central management of Access Levels and Access Policies

Identity-Aware Proxy (IAP)

Supported resource	How to use it
App Engine / Cloud Run / GKE	Enable IAP on the HTTPS LB backend
Compute Engine VM	Use IAP TCP forwarding for SSH/RDP — no bastion host needed
On-premises web apps	Publish via the IAP Connector

Google account authentication via OAuth 2.0
Grant access by binding users to roles/iap.httpsResourceAccessor in IAM
No VPN needed; safe to expose on a public IP

Access Levels in Context-Aware Access

Access Level "trusted-corp" =
  device.is_company_owned == true AND
  device.os == "ChromeOS" OR (device.os == "Windows" AND device.encryption_status == "ENCRYPTED") AND
  origin.region_code IN ("JP", "US") AND
  origin.ip IN_RANGE ("203.0.113.0/24")

VPC Service Controls (VPC SC)

Core concepts

Service Perimeter: A set of projects and services to be protected
Ingress Policy: Allow-list for API calls coming from outside the perimeter
Egress Policy: Allow-list for API calls leaving the perimeter
Access Level integration: Dynamic authorization based on context evaluation

Protected services (key ones)

BigQuery, Cloud Storage, Pub/Sub, Bigtable, Spanner
Cloud SQL, Cloud KMS, Cloud Functions, Cloud Run
Vertex AI, Dataflow, Dataproc
Artifact Registry, Container Registry

Operational patterns

Pattern	Description
Dry-run mode	Logs violations without actually blocking. Essential for validation before going live
Bridge perimeter	Used for inter-perimeter communication (deprecated; prefer Ingress/Egress)
Restricted VIP	Only allow VPC SC-enforced APIs via restricted.googleapis.com
Private Google Access	Reach VPC SC-protected APIs from inside the VPC over a private IP

Integrated zero-trust architecture (frequently asked)

Unify user identity with Cloud Identity / Workspace
Collect device posture via Endpoint Verification
Define Access Levels in Access Context Manager
Gate Web / SSH access through IAP
Protect API layers like BigQuery / GCS with VPC Service Controls
Mask PII with Cloud DLP / Sensitive Data Protection
Surface threats in Security Command Center

Common exam gotchas

VPC SC does not protect traffic inside Compute Engine VMs: Use Firewall Rules for that
IAP requires the IAM role iap.httpsResourceAccessor: roles/owner is not sufficient
VPC SC + Service Account: The SA is treated as the access source, so Ingress controls are required
Restricted VIP: Fixed at 199.36.153.4-7; Private DNS configuration is mandatory

What is BeyondCorp Enterprise?

It is the productized version of the internal zero-trust model Google has been running since 2011. No VPN is required: access decisions are made based on device posture, user identity, and context.

What does VPC Service Controls (VPC SC) protect?

It wraps the API layer of managed services like BigQuery, Cloud Storage, and Pub/Sub inside a perimeter to prevent data exfiltration. It provides API-level protection that network ACLs cannot reach.

How is IAP (Identity-Aware Proxy) related to BeyondCorp?

IAP is one of the core components of BeyondCorp. It sits in front of the HTTPS load balancer and performs OAuth authentication plus context evaluation. BeyondCorp Enterprise is the suite of IAP plus extras (Threat / DLP / Endpoint Verification).

What are the main attributes used by Context-Aware Access?

Device type, OS version, encryption status, company-owned vs personal, IP address, geographic location, and time of day. You combine these attributes to define Access Levels.

How many VPC SC perimeters can you create?

Up to 200 per organization (default). Inter-perimeter communication is governed via Ingress and Egress policies. Perimeter Bridge is deprecated; new designs should use Ingress/Egress rules.

Which services cannot be protected by VPC SC?

Application traffic inside Compute Engine VMs is out of scope (use VPC Firewall instead). VPC SC only covers managed API layers.

What is Chrome Enterprise Premium (formerly BeyondCorp Enterprise)?

Rebranded in 2024. It bundles Chrome browser management, zero-trust access, and DLP / Threat Prevention into a single product, absorbing ChromeOS and BeyondCorp Enterprise.

What is the common pattern for implementing zero trust on GCP?

Combine Cloud Identity + Endpoint Verification + IAP + Context-Aware Access + VPC SC to protect the API, Web, and Data layers. Pair it with AD federation and the rollout into existing enterprises is straightforward.

Check what you learned with practice questions

Practice with certification-focused question sets

Visit the GCP exam prep page

Author

NicheeLab Editorial Team

NicheeLab editorial team focused on data engineering and cloud certification learning. Content is structured around practical study needs and official exam domains.

GCP PCSE Exam Prep: Deep Dive into BeyondCorp Enterprise, VPC Service Controls, and IAP