Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise architecture team is designing a perimeter security strategy for an internal analytics application processing sensitive records across multiple Google Cloud projects. Authorized analysts execute queries in Project A against BigQuery datasets hosted in Project B. The security compliance team requires that data exfiltration to unauthorized Google Cloud storage resources or non-approved GCP projects be strictly prevented, even if an analyst possesses elevated IAM administrative privileges. The analysts must maintain seamless ability to query BigQuery datasets spanning both Project A and Project B. Which perimeter control architecture should the Cloud Architect recommend?

  1. Define a VPC Service Controls service perimeter that includes both Project A and Project B, and restrict the BigQuery API within the perimeter.Answer
  2. B
    Apply fine-grained IAM custom roles across Project A and Project B, explicitly revoking Cloud Storage object creation permissions from all analyst identities.
  3. C
    Establish VPC Network Peering between Project A and Project B, routing all BigQuery API traffic through a central hub VPC inspection appliance using transitive routing.
  4. D
    Grant primitive Viewer permissions to analysts on Project B while removing Owner and Editor roles to prevent bulk export functionality.

Answer

Define a VPC Service Controls service perimeter that includes both Project A and Project B, and restrict the BigQuery API within the perimeter.
Defining a VPC Service Controls perimeter around both Project A and Project B with the BigQuery API restricted effectively creates a cryptographic and network boundary. This permits communication between the two enclosed projects while preventing data exfiltration to any project or storage bucket outside the perimeter, even if an identity possesses administrative IAM privileges.

Step-by-Step Solution

1
Analyze the exfiltration threat vector
Identified that IAM permissions control who has authorization to access resources, but cannot restrict authorized users from moving data to external GCP projects or storage buckets outside administrative control.
Security requirements mandate preventing data movement to non-approved GCP projects even when users hold elevated IAM roles.
2
Evaluate perimeter control boundaries
Determine that VPC Service Controls (VPC SC) establishes a security boundary around GCP services and projects.
VPC SC blocks API requests that attempt to cross the defined boundary, preventing exfiltration to resources outside the perimeter.
3
Formulate multi-project perimeter architecture
Enclose both Project A (where queries run) and Project B (where datasets reside) inside a single unified VPC Service Controls perimeter with BigQuery restricted.
Including both projects allows legitimate cross-project query operations while isolating both projects from unauthorized external projects.

Key Concept

VPC Service Controls Perimeter Defense and Data Exfiltration Prevention
Estimated Time:2m 0s
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic