Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A biopharmaceutical enterprise processes sensitive clinical trial datasets stored within Cloud Storage buckets and BigQuery datasets hosted in Google Cloud. The security team requires that internal research applications running on-premises can securely access these resources, but must strictly prevent any credentialed insider or compromised service account from exfiltrating data to external Google Cloud Storage buckets or projects outside the corporate perimeter. IAM policies alone are insufficient to guarantee protection against data exfiltration. Which security architecture should a Professional Cloud Architect implement to satisfy these requirements?

  1. Establish a VPC Service Controls service perimeter enclosing the Cloud Storage and BigQuery resources, and configure Private Service Connect endpoints with ingress rules to allow restricted on-premises access.Answer
  2. B
    Configure fine-grained custom Identity and Access Management (IAM) roles restricting Storage Object Viewer permissions combined with an Organization Policy constraint blocking external IP access.
  3. C
    Set up VPC Network Peering between the on-premises network gateway VPC and the Google Cloud research VPC, relying on default VPC peering transitive routing to isolate traffic from external destinations.
  4. D
    Assign the primitive IAM Owner role to service accounts running the research workloads to enable GCP's automated perimeter protection policies across all project storage endpoints.

Answer

Establish a VPC Service Controls service perimeter enclosing the Cloud Storage and BigQuery resources, and configure Private Service Connect endpoints with ingress rules to allow restricted on-premises access.
VPC Service Controls creates a perimeter around GCP API services such as BigQuery and Cloud Storage. It blocks unauthorized communication and prevents credentialed users or service accounts from reading data inside the perimeter and copying it to resources outside the perimeter. Combining VPC Service Controls with Private Service Connect allows secure hybrid access from on-premises workloads.

Step-by-Step Solution

1
Identify the primary threat vector and security goal
The requirement is to prevent data exfiltration from Google Cloud managed services (Cloud Storage and BigQuery) even by authenticated identities.
IAM permissions grant access to identities but cannot restrict where authorized identities send or copy data once read.
2
Select the appropriate perimeter security boundary mechanism
VPC Service Controls creates a security boundary around GCP service APIs, preventing data transfers outside the designated perimeter.
VPC Service Controls mitigates exfiltration risks such as unauthorized copying to external storage buckets or projects.
3
Establish secure hybrid access into the service perimeter
Private Service Connect endpoints combined with perimeter ingress rules enable safe private connectivity from on-premises environments into restricted GCP APIs.
This allows authorized on-premises systems to communicate with the protected GCP services without exposing endpoints to the public internet.

Key Concept

VPC Service Controls Perimeter & Exfiltration Prevention
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic