Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A global supply-chain enterprise processes proprietary partner trade records in Google Cloud. Raw telemetry and financial datasets reside in BigQuery and Cloud Storage within a dedicated analytical GCP project. The platform team must fulfill two security mandates: first, mitigate volumetric Layer 7 request floods and web application attacks targeting public API frontend services; second, guarantee that authorized internal data analysts operating within the GCP network cannot exfiltrate analytical datasets to unauthorized external Google Cloud Storage buckets or external GCP organizations. Which TWO architectural solutions must the cloud architect implement to meet these requirements?

  1. Configure Google Cloud Armor security policies with rate-limiting rules and web application firewall (WAF) protections attached to the External HTTP(S) Load Balancer backend services.Answer
  2. Establish a VPC Service Controls perimeter around the analytical project to prevent fully authenticated IAM users from moving data to storage resources outside the perimeter boundary.Answer
  3. C
    Grant fine-grained IAM roles to data analysts while relying exclusively on IAM policies to block file transfers to external buckets outside the organization.
  4. D
    Assign the primitive Editor role to compute service accounts and set up transitive VPC Network Peering to seamlessly bridge network security perimeters across partner networks.

Answer

To protect against Layer 7 application attacks and prevent internal data exfiltration, the architecture must combine Google Cloud Armor edge policies on the External HTTP(S) Load Balancer with a VPC Service Controls security perimeter around project resources containing sensitive datasets.
Combining Google Cloud Armor and VPC Service Controls fulfills both security mandates. Cloud Armor inspects incoming traffic at the edge of Google's network to mitigate Layer 7 DDoS attacks and enforce rate limiting on public endpoints. Meanwhile, VPC Service Controls creates a perimeter around GCP managed services (BigQuery and Cloud Storage) within the analytical project, ensuring that even users with legitimate IAM access cannot exfiltrate data to external storage resources outside the perimeter.

Step-by-Step Solution

1
Analyze public ingress protection requirements against HTTP floods and application threats
Identify Google Cloud Armor as the GCP native edge control mechanism to enforce Layer 7 WAF and rate-limiting rules at the External HTTP(S) Load Balancer level.
Cloud Armor protects backend services from volumetric and application-layer DDoS attacks before traffic enters internal networks.
2
Analyze data exfiltration prevention requirements for authenticated users accessing BigQuery and Cloud Storage
Identify VPC Service Controls as the required boundary enforcement tool.
VPC Service Controls restricts API communication, blocking reads from inside the perimeter from writing to Google Cloud resources outside the perimeter boundary regardless of IAM permissions.
3
Evaluate and discard distractor strategies relying on IAM alone or transitive VPC peering
Confirm that IAM policies alone cannot prevent data exfiltration and transitive VPC peering is unsupported in GCP.
Relying on IAM without VPC SC leaves a vulnerability where authorized analysts can copy data to self-owned GCP projects.

Key Concept

Perimeter security defense-in-depth combining Google Cloud Armor for edge application security with VPC Service Controls for data exfiltration prevention.
Estimated Time:2m 0s
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic