Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A software enterprise is refining its perimeter defense architecture across multiple Google Cloud projects to satisfy stringent compliance mandates. Match each specific security requirement on the left with the corresponding Google Cloud perimeter control mechanism on the right that best satisfies the architectural goal.

  • Prevent unauthorized data exfiltration from Cloud Storage and BigQuery to external storage locations, even when requests stem from compromised high-privilege IAM credentials.VPC Service Controls Service Perimeters
  • Inspect incoming HTTP(S) traffic at the global edge to block Layer 7 SQL injection threats and apply rate-limiting rules prior to reaching workload endpoints.Cloud Armor Security Policies
  • Enforce consistent organizational network ingress rules across multiple VPCs by binding firewall policies to resource hierarchy nodes and dynamically targeting workloads using IAM-governed tags.Hierarchical Firewall Policies with Secure Tags
  • Enable workloads in an isolated private VPC network to securely access managed third-party services over private IP addresses without established VPC Network Peering.Private Service Connect (PSC) Endpoints

Answer

1. Data exfiltration prevention against compromised IAM credentials matches VPC Service Controls Service Perimeters.
2. Layer 7 SQL injection and rate-limiting at the edge matches Cloud Armor Security Policies.
3. Organization-wide ingress rules bound to hierarchy nodes with dynamic tagging matches Hierarchical Firewall Policies with Secure Tags.
4. Private IP access to third-party services without VPC peering matches Private Service Connect (PSC) Endpoints.
Each perimeter control fulfills a distinct security layer: VPC Service Controls protect API data boundaries against exfiltration; Cloud Armor provides edge L7 protective filtering; Hierarchical Firewall Policies with Secure Tags enforce top-down network access rules; and Private Service Connect enables private consumer-to-producer service endpoints without establishing VPC peering.

Step-by-Step Solution

1
Analyze the requirement for exfiltration prevention under credential compromise.
Identify that IAM permissions control WHO has access, whereas VPC Service Controls restrict FROM WHERE and TO WHERE APIs can transfer data. Thus, VPC Service Controls Service Perimeters fulfill this requirement.
IAM alone cannot prevent a compromised identity from copying data to an external bucket; a perimeter around APIs is required.
2
Analyze the requirement for edge Layer 7 filtering and rate-limiting.
Recognize that edge WAF capability attached to Global Load Balancers is provided by Cloud Armor Security Policies.
Cloud Armor provides web application firewall rulesets and edge DDoS/rate-limiting features.
3
Analyze the requirement for hierarchy-wide firewall enforcement using secure tags.
Identify Hierarchical Firewall Policies configured at the organization/folder level combined with Secure Tags.
Hierarchical firewalls enforce top-down rules across multiple VPCs without relying on network-level IP definitions.
4
Analyze the requirement for accessing external or third-party services privately without VPC peering.
Match with Private Service Connect (PSC) Endpoints.
PSC routes traffic via endpoint IP addresses in the consumer VPC to target service attachments without IP overlapping or transitive peering constraints.

Key Concept

Google Cloud Perimeter Security Architecture
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic