Examkin

Question

Difficulty: EasyNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A media distribution company stores proprietary video assets in a Google Cloud Storage bucket located within an isolated project. Although fine-grained IAM permissions strictly limit access to authorized developers, the security team must prevent these developers from copying data from the internal storage bucket to an external Google Cloud Storage bucket outside the organization. Which perimeter security control should be implemented to prevent this data exfiltration?

  1. Configure a VPC Service Controls service perimeter around the project housing the Cloud Storage bucket.Answer
  2. B
    Rely exclusively on fine-grained IAM storage roles while revoking all primitive roles from developer accounts.
  3. C
    Establish VPC Network Peering between the workload VPC and external project VPCs to inspect API traffic transitively.
  4. D
    Grant primitive Owner IAM roles restricted by an Organization Policy constraint on external bucket creation.

Answer

Configure a VPC Service Controls service perimeter around the project housing the Cloud Storage bucket.
Configuring a VPC Service Controls service perimeter around the project isolates Google Cloud service APIs (like Cloud Storage). It ensures that data cannot be read from within the perimeter and written to storage resources outside the defined boundary, effectively mitigating data exfiltration risks by authorized identities.

Step-by-Step Solution

1
Analyze the security requirement
The requirement asks to block authorized users from exfiltrating data from an internal Cloud Storage bucket to an external storage bucket outside the organization boundary.
Understanding the threat vector distinguishes between identity-based access control (IAM) and perimeter-based exfiltration control.
2
Evaluate Google Cloud perimeter security capabilities
VPC Service Controls creates a security perimeter around Google Cloud managed services (such as Cloud Storage) to restrict API access and prevent data transfers across the perimeter boundary.
VPC Service Controls prevents authorized users from writing data outside the perimeter even if their IAM credentials permit storage API calls.

Key Concept

VPC Service Controls Data Exfiltration Prevention
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic