Examkin

Question

Difficulty: EasySecurity Logging, Audit Logs, and Security Command Center

An enterprise security team has configured Cloud Audit Logs to track all read and write operations on sensitive Cloud Storage buckets containing proprietary financial data. However, the security architect wants to ensure that authorized internal users holding valid IAM read permissions cannot copy data from these corporate buckets into external Cloud Storage buckets outside the organizational boundary. Which GCP security component must be implemented alongside IAM to prevent this unauthorized data exfiltration?

  1. Implement VPC Service Controls around the Cloud Storage API to establish a security perimeter that restricts data transfer across perimeter boundaries.Answer
  2. B
    Assign primitive Owner roles to the security administrators to override external storage API export requests.
  3. C
    Switch bucket encryption from Customer-Managed Encryption Keys (CMEK) to Customer-Supplied Encryption Keys (CSEK).
  4. D
    Grant the Service Account Admin role to the workload service accounts instead of the Service Account User role.

Answer

Implementing VPC Service Controls establishes a boundary around Google Cloud services like Cloud Storage, preventing authorized credentials from copying data to external projects or locations outside the perimeter.
VPC Service Controls allow organizations to define perimeter boundaries around Google Cloud resources and services (such as Cloud Storage). Even if an identity possesses valid IAM permissions to read data inside the perimeter, VPC Service Controls prevent that data from being copied or transferred to storage resources outside the perimeter boundary.

Step-by-Step Solution

1
Analyze the threat vector described in the scenario.
Identified that authorized users with legitimate IAM read permissions can still exfiltrate data to an unauthorized destination outside the organization.
IAM grants permission to perform actions, but standard IAM alone does not restrict destination boundaries for data movement.
2
Evaluate GCP security controls designed specifically for exfiltration prevention.
VPC Service Controls restrict communication to and from restricted GCP APIs across defined enterprise perimeters.
VPC Service Controls block requests that attempt to read from a protected resource and write to a resource outside the perimeter, even if IAM permissions would otherwise allow it.

Key Concept

VPC Service Controls for Data Exfiltration Prevention
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic