Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A healthcare organization processes Electronic Health Records (EHR) stored in BigQuery and Cloud Storage inside a dedicated Google Cloud project named Project-Analytics. Authorized analysts access these services from an on-premises datacenter via a Dedicated Interconnect connection. To satisfy regulatory mandates, the security team must enforce two controls: 1) Authorized internal users with valid IAM permissions must be strictly prevented from copying datasets to unauthorized external Google Cloud storage locations or external projects. 2) An analytics service running in a separate VPC inside Project-App must securely query BigQuery in Project-Analytics using internal IP routing, without granting Project-App network visibility to all other resources in Project-Analytics. Which architectural design should you recommend?

  1. Configure a VPC Service Controls perimeter around Project-Analytics to restrict service API communication to authorized perimeter boundary rules. Create a Private Service Connect endpoint in Project-App to privately connect to BigQuery in Project-Analytics, and define VPC Service Controls ingress and egress rules to grant explicit cross-perimeter API access.Answer
  2. B
    Grant the BigQuery Admin and Storage Admin IAM roles to the analytics team service accounts, and establish VPC Network Peering between Project-App's VPC and Project-Analytics's VPC to route traffic privately over internal IP addresses.
  3. C
    Establish VPC Network Peering between Project-App and a central Hub VPC network, which is already peered with Project-Analytics, to leverage multi-hop routing for BigQuery queries while assigning predefined IAM roles.
  4. D
    Assign the primitive Editor role at the project level to Project-App's service account, and attach Google Cloud Armor security policies directly to Cloud Storage buckets and BigQuery datasets to filter unauthorized access.

Answer

Configure a VPC Service Controls perimeter around Project-Analytics to restrict service API egress, and use Private Service Connect endpoints with perimeter ingress/egress rules for private cross-project service access.
VPC Service Controls establishes a security boundary around GCP service APIs like Cloud Storage and BigQuery, preventing sensitive healthcare data from being copied or exfiltrated to external projects even by authorized users. Private Service Connect allows Project-App to privately access BigQuery endpoints in Project-Analytics without opening full VPC-to-VPC routing, while VPC Service Controls ingress and egress rules allow controlled cross-perimeter communication.

Step-by-Step Solution

1
Identify data exfiltration prevention requirements
IAM permissions control authentication and authorization, but do not prevent authorized users from exfiltrating data to external GCP projects or storage locations.
A perimeter-based defense at the Google Cloud API layer is necessary to enforce resource boundary isolation.
2
Evaluate VPC Service Controls for perimeter security
Enclosing Project-Analytics within a VPC Service Controls perimeter prevents Google Cloud service APIs (BigQuery and Cloud Storage) from transferring data outside the boundary.
VPC SC enforces policy boundaries directly at the service endpoint layer.
3
Implement private service communication without full network peering
Deploying Private Service Connect (PSC) endpoints alongside VPC SC ingress and egress rules permits Project-App to query BigQuery securely while maintaining non-transitive, isolated network boundaries.
PSC enables explicit service-level connectivity over private IP addresses without peering entire VPC networks.

Key Concept

Data Exfiltration Prevention via VPC Service Controls and Private Service Connect
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic