Examkin

Question

Difficulty: EasyNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An organization needs to ensure that authorized users cannot copy sensitive data stored in Cloud Storage to external, unauthorized Google Cloud projects. Which Google Cloud security feature should be configured to establish this security boundary?

  1. VPC Service Controls service perimeters around the projectAnswer
  2. B
    Fine-grained Identity and Access Management (IAM) custom roles restricting bucket permissions
  3. C
    Transitive VPC Network Peering to route all service traffic through a central inspection project
  4. D
    Primitive IAM Viewer roles on the project level instead of object-level permissions

Answer

VPC Service Controls service perimeters around the project
VPC Service Controls allow security administrators to define perimeter boundaries around Google Cloud resources to prevent sensitive data from being moved outside controlled network environments.

Step-by-Step Solution

1
Identify the primary threat and boundary requirement in the scenario.
The requirement is preventing data exfiltration to unauthorized Google Cloud projects by authorized users.
Exfiltration prevention requires restricting access to Google API services at the perimeter level.
2
Evaluate the capabilities of VPC Service Controls.
VPC Service Controls block API communication to resources outside the defined service perimeter.
It acts as a perimeter control for Google-managed APIs like Cloud Storage.

Key Concept

VPC Service Controls for Data Exfiltration Prevention
Estimated Time:1m 0s
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic