Examkin

Question

Difficulty: Very hardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A global financial organization is deploying a multi-tier enterprise application on Google Cloud under strict zero-trust boundary requirements. As the principal cloud architect, match each enterprise architectural security constraint to the corresponding GCP network perimeter control mechanism that fulfills the requirement.

  • Prevent unauthorized API-level exfiltration of sensitive BigQuery datasets, even if identity credentials within an authorized VPC subnet are fully compromised.VPC Service Controls boundary enforcing a service perimeter around BigQuery resources coupled with egress rules and restricted VIP routing.
  • Mitigate volumetric application-layer (Layer 7) DDoS attacks and SQL injection attempts at the edge before traffic hits backend services.Cloud Armor enterprise security policy incorporating OWASP WAF rulesets and adaptive rate-limiting bound to the Global External HTTP(S) Load Balancer.
  • Enforce organization-wide restriction of inbound SSH access to private compute instances based on workload identity context rather than IP subnet ranges.Hierarchical Firewall Policies configured with Secure Tags evaluated across the organization resource hierarchy.
  • Enable on-premises applications to securely invoke Google Cloud APIs over Dedicated Interconnect while blocking all outbound traffic to non-approved Google Cloud services.Private Service Connect endpoint targeting the restricted Google APIs bundle (`restricted.googleapis.com`) advertised via BGP over Cloud Interconnect.

Answer

Each architectural security constraint maps to its precise GCP perimeter mechanism: BigQuery exfiltration prevention requires VPC Service Controls with restricted VIP routing; Layer 7 DDoS and SQLi mitigation requires Cloud Armor enterprise security policies at the edge; organization-wide identity-based firewall rules require Hierarchical Firewall Policies with Secure Tags; private on-premises API access restricting unapproved services requires Private Service Connect targeting restricted Google APIs over Interconnect.
The correct pairings accurately align each Google Cloud perimeter defense tool with its explicit architectural security boundary. VPC Service Controls isolate API-level communication for data exfiltration defense; Cloud Armor provides edge WAF and DDoS filtering for public endpoints; Hierarchical Firewall Policies with Secure Tags establish non-bypassable centralized access controls across instance identities; and Private Service Connect with the restricted VIP secures hybrid enterprise access exclusively to compliant Google APIs.

Step-by-Step Solution

1
Analyze the data exfiltration constraint for BigQuery under credential compromise.
Identify that IAM alone cannot prevent exfiltration if credentials are stolen; VPC Service Controls perimeter boundaries are mandatory to block unauthorized data movements across API boundaries.
VPC Service Controls mitigate risk from compromised credentials by validating the perimeter boundary regardless of identity permissions.
2
Evaluate perimeter edge protection against Layer 7 attacks.
Match SQL injection and HTTP DDoS protection to Google Cloud Armor attached to Global External Load Balancing.
Cloud Armor inspects HTTP(S) traffic at the Google network edge, preventing malicious payloads from reaching backend instances.
3
Determine organization-wide network policy enforcement based on workload context.
Select Hierarchical Firewall Policies coupled with Secure Tags.
Hierarchical policies enforce consistent rules down the resource tree, and Secure Tags allow dynamic context matching independent of IP address ranges.
4
Formulate private hybrid connectivity to Google APIs with service restriction.
Combine Private Service Connect (PSC) targeting restricted Google APIs (`restricted.googleapis.com`) with Cloud Interconnect BGP advertising.
The restricted VIP endpoint blocks access to non-VPC-SC supported services, preventing exfiltration to unapproved public GCP endpoints.

Key Concept

Perimeter Security Architecture and Defense-in-Depth on GCP
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic