In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized. Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

Payment Card Industry Data Security Standard (PCI DSS) requirement 1.3.4 requires restricting outbound traffic from the cardholder data environment to only what is necessary. Both Compute Engine and Google Kubernetes Engine (GKE) instances reside within a Virtual Private Cloud (VPC). VPC firewall rules can be configured to explicitly allow authorized egress traffic and deny all other outbound connections by default. This provides a direct mechanism to meet the requirement. GKE further enhances this with Network Policies, which control traffic at the pod and namespace level, offering even more granular control over egress traffic.

A. App Engine standard environment has limited native egress controls. Achieving granular control requires a Serverless VPC Access connector, which is an additional component not inherent to the base offering.
B. Cloud Functions, similar to App Engine, requires a Serverless VPC Access connector to route egress traffic through a VPC where firewall rules can be applied, making it an indirect solution.
E. Cloud Storage is an object storage service. It does not initiate outbound network connections in the way compute services do, so egress firewall rules are not its primary security control.

1. Google Cloud. (2023). VPC firewall rules overview. "Firewall rules let you allow or deny traffic to and from your virtual machine (VM) instances... Every VPC network has two implied firewall rules that block all incoming connections and allow all outgoing connections." Section: Implied rules.

2. Google Cloud. (2023). Google Kubernetes Engine (GKE) Network policy. "Network policies are the Kubernetes way of firewalling, at the pod level... You can use network policies to control egress traffic from a pod." Section: What network policy does.

3. Google Cloud. (2022). PCI DSS Compliance on Google Cloud Platform. Page 15, Section 1.2.1, "Google Cloud VPC firewall rules can be used to restrict traffic between instances... and to restrict ingress and egress traffic to the Internet."