Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise financial institution is modernizing its Google Cloud architecture to satisfy strict regulatory compliance and perimeter security mandates. The architecture team must evaluate and assign the appropriate network security control mechanism to meet four distinct security requirements across their multi-project environment.

Match each architectural security requirement with the corresponding Google Cloud network security mechanism that best satisfies it.

  • Mitigate Layer 7 web application attacks such as SQL injection and enforce IP-based rate limiting at the Google Cloud network edge.Cloud Armor Security Policies
  • Prevent authorized IAM users in a sensitive analytics project from copying BigQuery datasets to unauthorized external cloud resources.VPC Service Controls Service Perimeter
  • Enforce mandatory, non-overridable organization-wide ingress firewall deny rules across all current and future VPC networks.Hierarchical Firewall Policies
  • Provide private, isolated access to a third-party managed SaaS application residing in an external GCP organization without using transitive VPC peering.Private Service Connect (PSC) Endpoints

Answer

Layer 7 inspection and edge rate limiting map to Cloud Armor Security Policies. BigQuery exfiltration prevention maps to VPC Service Controls Service Perimeter. Organization-wide non-overridable firewall rules map to Hierarchical Firewall Policies. Private third-party SaaS connectivity without VPC peering maps to Private Service Connect (PSC) Endpoints.
Each requirement aligns directly with a distinct layer of Google Cloud's defense-in-depth architecture. Cloud Armor provides edge WAF and DDoS protection for web workloads. VPC Service Controls form logical security perimeters around GCP APIs to block data exfiltration. Hierarchical Firewall Policies enforce top-down network security rules that project owners cannot modify. Private Service Connect delivers private, consumer-endpoint access to SaaS or producer services across project boundaries.

Step-by-Step Solution

1
Analyze the Layer 7 web threat mitigation requirement.
Identified Cloud Armor Security Policies as the edge defense attached to HTTP(S) Load Balancers.
Cloud Armor operates at the network edge to filter web traffic against OWASP Top 10 risks and apply rate-limiting rules.
2
Analyze the data exfiltration prevention requirement for managed GCP services.
Identified VPC Service Controls as the perimeter boundary mechanism.
IAM controls who can access resources, but VPC Service Controls restrict from where and to where API requests can move data, effectively preventing exfiltration.
3
Analyze the centralized governance firewall requirement.
Identified Hierarchical Firewall Policies attached at Folder or Organization nodes.
Hierarchical firewall rules inherit down the resource hierarchy and take precedence over local VPC firewall rules, preventing local project admin overrides.
4
Analyze the cross-tenant private service connectivity requirement.
Identified Private Service Connect (PSC) Endpoints.
PSC allows unidirectional, private IP connectivity between independent GCP project/organization VPCs without requiring full network peering topology.

Key Concept

Google Cloud Perimeter Security and Network Controls
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic