A Google Cloud control that creates security perimeters around managed services (BigQuery, Cloud Storage, etc.) to prevent data exfiltration, even when the identity accessing them has valid IAM permissions.
In CDL it complements IAM: IAM decides who can access; VPC Service Controls limits where the data can be accessed from and moved to. Question: prevent an employee from copying BigQuery data to an external project → VPC Service Controls.
VPC Service Controls is a concept that can show up on the exam. Check the full guide to see it in context.