Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A satellite earth observation enterprise processes high-resolution imagery stored in Google Cloud Storage buckets and BigQuery datasets located within a dedicated project named proj-geo-data. Internal analytics applications run on Compute Engine instances within a private Virtual Private Cloud (VPC). The security architecture team requires that even if a valid user identity or service account credential is compromised, data cannot be copied or exfiltrated to external Cloud Storage buckets outside the organizational boundary. Additionally, authorized on-premises analysts must access these storage and database services through private network paths without traversing the public internet. Which solution architecture satisfies these security and access requirements?

  1. Configure a VPC Service Controls service perimeter that encloses proj-geo-data with Cloud Storage and BigQuery configured as restricted services, and set up Private Service Connect endpoints with the Restricted VIP to route on-premises traffic internally to Google APIs.Answer
  2. B
    Grant minimal predefined IAM roles such as Storage Object Viewer and BigQuery Data Viewer to application service accounts and analysts, while revoking all primitive Owner and Editor permissions across the resource hierarchy.
  3. C
    Establish VPC Network Peering between the internal analytics VPC and a central transit VPC connected to the on-premises network via Cloud VPN, relying on transitive peering to route all storage and BigQuery API calls securely.
  4. D
    Assign the primitive Owner IAM role exclusively to a central security admin service account and deploy a Cloud Armor edge security policy targeting the private IP addresses of the internal Compute Engine instances.

Answer

The correct architecture is to establish a VPC Service Controls service perimeter enclosing the project with Cloud Storage and BigQuery as restricted services, combined with Private Service Connect or Restricted VIP routing for private on-premises API connectivity.
Establishing a VPC Service Controls perimeter around the project housing Cloud Storage and BigQuery guarantees that API requests to restricted services are validated against perimeter boundaries. Even if a user has valid IAM read permissions, VPC Service Controls prevents reading data from inside the perimeter and copying it to a Cloud Storage bucket outside the perimeter. Using Private Service Connect endpoints or the Restricted VIP ensures that on-premises users reach Google services over private Interconnect/VPN tunnels without using public IP addresses.

Step-by-Step Solution

1
Analyze the exfiltration prevention requirement
Identified that IAM controls access but does not restrict destination targets for API calls.
VPC Service Controls is specifically designed to create a network-level boundary around GCP services like Cloud Storage and BigQuery to prevent data exfiltration to resources outside the perimeter.
2
Analyze the private network connectivity requirement for on-premises analysts
Identified that accessing Google APIs privately from on-premises requires Private Google Access or Private Service Connect.
Configuring Private Service Connect or the Restricted VIP (199.36.153.4/30) allows hybrid networks to resolve *.googleapis.com to private IP endpoints, keeping traffic off the public internet and remaining compliant with the VPC Service Controls perimeter.

Key Concept

VPC Service Controls and Private Access Mechanisms
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic