Examkin

Question

Difficulty: EasySecurity Logging, Audit Logs, and Security Command Center

An organization needs to prevent authorized users from exfiltrating sensitive data stored in Cloud Storage buckets to unauthorized external locations outside the organization, even if the users possess valid IAM read permissions. Which Google Cloud security feature should be implemented to enforce this perimeter boundary?

  1. Configure VPC Service Controls to establish a security perimeter around Cloud Storage resources.Answer
  2. B
    Rely exclusively on fine-grained IAM Storage Object Viewer roles assigned to trusted users.
  3. C
    Assign primitive Owner roles to service accounts to restrict resource modification permissions.
  4. D
    Enforce Customer-Supplied Encryption Keys (CSEK) for all data written to the Cloud Storage buckets.

Answer

Configure VPC Service Controls to establish a security perimeter around Cloud Storage resources.
VPC Service Controls allow security teams to define perimeters around Google Cloud APIs and resources like Cloud Storage. This blocks data egress and prevents unauthorized data transfers to resources outside the perimeter, even when the request is made by an authenticated user with valid IAM permissions.

Step-by-Step Solution

1
Analyze the security requirement.
The target requirement is to prevent exfiltration of data to unauthorized external locations by users who have legitimate IAM access.
Standard IAM authorization allows reading data, but does not constrain where that data can be transferred.
2
Select the appropriate network perimeter control in GCP.
VPC Service Controls define network security perimeters around GCP services.
VPC Service Controls restrict egress communication and API access to resources strictly within the defined security perimeter.

Key Concept

Data exfiltration prevention with VPC Service Controls
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic