Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise financial organization stores sensitive customer data in BigQuery datasets within Google Cloud. Security policies mandate that analysts working within the internal network must be able to query the data, but must be strictly prevented from copying or exporting dataset contents to external, non-company Google Cloud Storage buckets or datasets, even if the analysts possess administrative IAM permissions. Which solution should a Cloud Architect implement to meet these security requirements?

  1. Configure a VPC Service Controls perimeter around the project containing BigQuery and Cloud Storage, restricting service API access and preventing data movement across the perimeter boundary.Answer
  2. B
    Implement granular Identity and Access Management (IAM) custom roles that revoke object export privileges while retaining query execution permissions.
  3. C
    Establish VPC Network Peering between internal and external project networks and rely on transitive VPC routing boundaries to restrict destination traffic.
  4. D
    Grant primitive IAM Viewer roles to analysts across all projects and configure Cloud Audit Logging to monitor for unauthorized data export activity.

Answer

Configure a VPC Service Controls perimeter around the project containing BigQuery and Cloud Storage, restricting service API access and preventing data movement across the perimeter boundary.
VPC Service Controls defines security perimeters around GCP service resources (such as BigQuery and Cloud Storage) to mitigate data exfiltration risks. It blocks API communication between perimetrized services and external resources, ensuring data cannot be transferred out even by users with high-privilege IAM roles.

Step-by-Step Solution

1
Identify the primary threat vector in the scenario.
The core risk is data exfiltration by authorized identities possessing broad IAM privileges.
IAM roles specify who can interact with resources, but cannot restrict the destination project or perimeter when data is copied across Google Cloud APIs.
2
Evaluate perimeter control mechanisms on Google Cloud.
VPC Service Controls establishes a boundary around GCP resources to isolate services like BigQuery and Cloud Storage.
This prevents data from being copied or exfiltrated outside the defined perimeter boundary regardless of IAM permissions.

Key Concept

VPC Service Controls exfiltration prevention
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic