Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise organization operates a Private Google Kubernetes Engine (GKE) cluster in Project A that processes sensitive analytics data stored in a Cloud Storage bucket in Project B. Strict compliance mandates require that data cannot traverse the public internet, data exfiltration to external storage locations must be prevented even if an identity possesses broad IAM storage roles, and administrative access to the GKE master endpoint must be restricted exclusively to a management bastion subnet located in Project C. Which network security design should you implement to meet all requirements?

  1. A
    Grant fine-grained IAM roles to the GKE service account for the Project B Cloud Storage bucket and enforce IAM Conditions based on source IP ranges, relying on IAM policies to block data exfiltration.
  2. B
    Peer the VPC network in Project C to Project A, and peer Project A to Project B, relying on transitive VPC Network Peering to route GKE control plane management traffic and Cloud Storage access across all projects.
  3. Enclose Project A and Project B inside a VPC Service Controls perimeter, enable Private Google Access for Cloud Storage connectivity, and configure GKE Control Plane Authorized Networks to limit master endpoint access to the Project C management subnet range.Answer
  4. D
    Assign primitive Owner permissions to the cluster service account to bypass cross-project network restrictions, while exposing the GKE master endpoint publicly behind Cloud Armor IP filtering rules.

Answer

Enclose Project A and Project B inside a VPC Service Controls perimeter to prevent data exfiltration, utilize Private Google Access for private API communication, and configure GKE Control Plane Authorized Networks to restrict administration to the Project C management subnet.
VPC Service Controls provides perimeter security that isolates Google API service communications for Project A and Project B, preventing data exfiltration to unauthorized buckets even when identities hold high-level IAM roles. Private Google Access routes storage traffic internally, while GKE Control Plane Authorized Networks specifies the exact authorized subnet range from Project C permitted to reach the GKE master API endpoint.

Step-by-Step Solution

1
Address data exfiltration prevention across projects.
Placing Project A and Project B inside a VPC Service Controls perimeter creates a security boundary that blocks copying or moving data to unauthorized external GCP resources, even if an identity has IAM Storage Admin permissions.
IAM grants access permissions but cannot prevent an authorized user from writing data to an external, untrusted bucket without VPC Service Controls.
2
Ensure private connectivity to Google APIs.
Enabling Private Google Access allows GKE nodes with private IP addresses to communicate securely with Cloud Storage without using public IP addresses or routing over the public internet.
Compliance mandates require all network traffic to Google services to stay off the public internet.
3
Secure GKE cluster control plane administration.
Configuring Control Plane Authorized Networks on the GKE private cluster restricts API server endpoint access strictly to specified IP blocks, such as the management bastion subnet in Project C.
Private GKE control planes require authorized network rules to specify which management subnets can reach the Kubernetes master endpoint.

Key Concept

VPC Service Controls & GKE Perimeter Security
Estimated Time:2m 0s
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic