Examkin

Question

Difficulty: EasyNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise security team must ensure that authorized users inside an organization cannot exfiltrate sensitive data from Google Cloud Storage buckets into external, unauthorized projects. Which Google Cloud feature should the architecture team implement to establish a security perimeter around these managed service resources?

  1. VPC Service ControlsAnswer
  2. B
    Identity and Access Management (IAM) permissions alone
  3. C
    VPC Network Peering
  4. D
    Primitive IAM Roles at the Organization Level

Answer

VPC Service Controls
VPC Service Controls enable organizations to construct a perimeter around managed Google Cloud services such as Cloud Storage. This prevents data exfiltration by restricting API calls to authorized services and projects inside the perimeter.

Step-by-Step Solution

1
Identify the primary security requirement
The goal is to prevent data exfiltration from Google Cloud Storage by authorized users to external storage locations.
Standard IAM permissions grant resource access to users, but do not prevent authorized users from copying data outside corporate perimeter boundaries.
2
Evaluate perimeter security services in Google Cloud
VPC Service Controls isolate Google Cloud service APIs (like Cloud Storage) within a configured service perimeter.
VPC Service Controls block data exfiltration by restricting network access to specified Google Cloud services based on caller context and target destination.

Key Concept

VPC Service Controls Service Perimeters
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic