Match each enterprise security requirement with the Google Cloud perimeter control mechanism best suited to fulfill it according to GCP architectural best practices.
- Preventing sensitive data exfiltration from Google-managed storage services (e.g., Cloud Storage, BigQuery) to external projects, even if administrator IAM credentials are compromised.VPC Service Controls security perimeters
- Mitigating Layer 7 application attacks (such as SQL injection and cross-site scripting) and implementing rate limiting at the global edge network before traffic hits backends.Cloud Armor security policies attached to External HTTP(S) Load Balancers
- Enforcing mandatory, organization-wide firewall rules at the folder or organization level that cannot be overridden by individual project administrators.Hierarchical firewall policies using Secure Tags
- Providing private, internal IP connectivity from on-premises environments to Google APIs and managed services without relying on public IP addresses or complex VPC peering topologies.Private Service Connect (PSC) endpoints
Answer
The optimal alignment matches: 1) Data exfiltration defense despite compromised IAM credentials to VPC Service Controls security perimeters. 2) Layer 7 protection and edge rate-limiting to Cloud Armor security policies. 3) Non-overridable organization-level firewall rules to Hierarchical firewall policies using Secure Tags. 4) Private on-premises and internal access to Google APIs to Private Service Connect endpoints.
Each control maps directly to its perimeter security domain: VPC Service Controls creates logical perimeters around GCP APIs to block data exfiltration; Cloud Armor provides edge WAF and DDoS protection for public endpoints; Hierarchical firewall policies enforce org-wide security governance using Secure Tags; Private Service Connect delivers private, internal IP access to Google APIs.
Step-by-Step Solution
Key Concept
GCP Perimeter Security and Defense-in-Depth Mechanisms