Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A financial enterprise hosts sensitive customer data within a Google Cloud project containing BigQuery datasets and Cloud Storage buckets. The enterprise policy mandates that authorized internal service accounts must access Google APIs, but data must strictly be prevented from being exfiltrated to external Google Cloud projects or unauthorized public Internet destinations. Which architectural solution should you implement to satisfy these security constraints?

  1. Configure a VPC Service Controls service perimeter around the project, and define explicit perimeter egress and ingress rules alongside Private Service Connect endpoints for Google APIs.Answer
  2. B
    Grant IAM fine-grained storage permissions to service accounts and rely strictly on IAM policy enforcement to restrict dataset export actions.
  3. C
    Establish VPC Network Peering between the workload VPC and a centralized security VPC, assuming transitive routing will filter exfiltration traffic across peered networks.
  4. D
    Assign the primitive Owner role to administrative service accounts to automatically override perimeter blocks for authorized background jobs.

Answer

Configure a VPC Service Controls service perimeter around the project, and define explicit perimeter egress and ingress rules alongside Private Service Connect endpoints for Google APIs.
VPC Service Controls creates a security perimeter around Google Cloud resources like BigQuery and Cloud Storage. By restricting network ingress and egress and using Private Service Connect endpoints, organizations prevent data exfiltration to unauthorized storage locations or external projects, even if the request originates from a valid, credentialed IAM identity.

Step-by-Step Solution

1
Analyze security and exfiltration requirements
Identified the need to prevent authorized identities from exfiltrating data outside the trusted boundary.
Standard IAM permissions grant access to read data, but cannot restrict where an authorized user or service account writes or copies that data.
2
Evaluate perimeter control mechanisms in GCP
Determined that VPC Service Controls creates a isolation perimeter around Google Cloud APIs and services (e.g., BigQuery, Cloud Storage).
VPC Service Controls prevents data copy/exfiltration across perimeter boundaries regardless of IAM privilege level.
3
Design private connectivity for perimeter access
Selected Private Service Connect endpoints combined with perimeter ingress/egress rules to enable secure, controlled API access.
Provides private IP connectivity to Google managed services without exposure to public endpoints while respecting perimeter boundaries.

Key Concept

VPC Service Controls data exfiltration prevention
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic