You need to enable VPC Service Controls and allow changes to perimeters in existing environments without preventing access to resources. Which VPC Service Controls mode should you use?

VPC Service Controls provides a "dry run" mode specifically for testing service perimeters without impacting existing environments. In dry run mode, perimeter configurations are not enforced. Instead, any requests that would have been denied by the perimeter policy are logged for analysis. This allows administrators to understand the potential impact of their perimeter rules, identify necessary policy adjustments, and validate configurations before moving to the "enforced" mode where violations are actively blocked.

A. Cloud Run is a serverless compute platform for running containers; it is not a mode within VPC Service Controls.
B. "Native" is not a valid mode for VPC Service Controls. The two primary modes are "enforced" and "dry run".
C. "Enforced" mode actively blocks any access that violates the perimeter policy. This is the opposite of the requirement to allow changes without preventing access.

1. Google Cloud Documentation, "Service perimeter dry run mode". The documentation states, "Dry run mode helps you reduce the risk of breaking existing applications when you enable VPC Service Controls... In dry run mode, requests that violate the perimeter policy are not denied. Instead, the violations are logged."

2. Google Cloud Documentation, "VPC Service Controls overview". It explains the core concepts, including the distinction between enforced and dry run configurations.

3. Google Cloud Documentation, "Dry run configuration details". This page details how to create a dry run configuration and how to analyze the resulting audit logs to refine perimeter policies before enforcement.