Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An automotive IoT enterprise ingests streaming vehicle telemetry into Cloud Storage buckets located inside Project-Ingest. An analytics team operating out of Project-Analytics requires direct read access to this telemetry to run BigQuery Omni and Dataproc jobs. The chief information security officer (CISO) mandates that raw telemetry data must be strictly prevented from being exfiltrated to external Google Cloud resources or public internet destinations, even by identities holding legitimate read permissions. Additionally, Project-Analytics is connected via VPC Network Peering to a shared Project-Management network, but Project-Ingest has no direct VPC Network Peering connection to Project-Management. Which security architecture should a Cloud Architect implement to satisfy these security and operational requirements?

  1. Configure a single VPC Service Controls perimeter that includes both Project-Ingest and Project-Analytics, restricting Google Cloud Storage and BigQuery API traffic to the restricted.googleapis.com IP range.Answer
  2. B
    Grant fine-grained IAM Storage Object Viewer roles to the analytics team's service account without establishing a VPC Service Controls perimeter.
  3. C
    Route all API requests from Project-Ingest through Project-Analytics to reach Project-Management by relying on the transitive properties of the existing VPC Network Peering connection.
  4. D
    Assign the primitive Editor IAM role to the analytics service account across Project-Ingest and Project-Analytics to enable automatic cross-project API access.

Answer

Configure a single VPC Service Controls perimeter encompassing both projects while routing API traffic through restricted Google APIs.
The correct solution involves creating a VPC Service Controls perimeter containing both Project-Ingest and Project-Analytics, configured with restricted API access. VPC Service Controls isolates sensitive data within specified GCP projects, preventing credentials from being used to copy data to external, non-perimeter storage buckets or locations even if the user has read permissions.

Step-by-Step Solution

1
Analyze perimeter security and exfiltration requirements
Identified that IAM alone cannot prevent an authorized identity from writing data to an external location.
VPC Service Controls is specifically designed to isolate Google Cloud service resources and mitigate data exfiltration risks.
2
Evaluate network connectivity constraints
Recognized that VPC Network Peering is non-transitive in GCP.
Peering relationships cannot be chained transitively to route traffic between non-directly peered networks.
3
Formulate perimeter architecture
Place Project-Ingest and Project-Analytics inside a VPC Service Controls service perimeter and enforce restricted VIP endpoints (restricted.googleapis.com).
This guarantees that API access between the projects works securely while blocking egress of data outside the defined perimeter.

Key Concept

VPC Service Controls and Perimeter Defense
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic