Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A multinational financial processing enterprise is designing perimeter controls for its multi-tenant workload architecture on Google Cloud. Match each specific network security requirement on the left with the most appropriate Google Cloud perimeter control mechanism on the right.

  • Prevent data exfiltration from managed analytics services like BigQuery and Cloud Storage to unauthorized external resources, even when authenticated with valid IAM credentials.VPC Service Controls
  • Inspect incoming HTTPS traffic at the edge of Google Cloud External HTTP(S) Load Balancers to mitigate Layer 7 SQL injection and cross-site scripting (XSS) attacks.Cloud Armor Security Policies
  • Enforce mandatory baseline egress network firewall rules across all VPC networks across all folders in the GCP organization without allowing project administrators to override them.Hierarchical Firewall Policies
  • Enable private, unidirectionally exposed access to a third-party SaaS partner application hosted in an external VPC without establishing full VPC Network Peering.Private Service Connect

Answer

Data exfiltration prevention matches VPC Service Controls; Layer 7 HTTPS threat protection matches Cloud Armor Security Policies; Organization-level enforced network security rules match Hierarchical Firewall Policies; Private third-party service access without peering matches Private Service Connect.
Each perimeter control satisfies a distinct security layer in Google Cloud: VPC Service Controls protect API and storage service boundaries against data exfiltration; Cloud Armor provides Layer 7 WAF protections at the load balancer edge; Hierarchical Firewall Policies mandate organization-level network restrictions across the resource hierarchy; Private Service Connect provides secure, isolated service access across networks without establishing network peering.

Step-by-Step Solution

1
Analyze data exfiltration prevention requirement for managed GCP services.
Identified that IAM alone cannot prevent unauthorized egress of data to external buckets; VPC Service Controls establish explicit perimeter boundaries.
VPC Service Controls block network-level access to API resources from outside the designated perimeter.
2
Evaluate web application security requirements at the load balancer edge.
Identified Cloud Armor as the WAF filter operating at the HTTP(S) load balancer level for Layer 7 protection.
Cloud Armor evaluates pre-configured WAF rules (SQLi, XSS) before traffic reaches compute backends.
3
Identify resource hierarchy control for enterprise-wide firewall governance.
Selected Hierarchical Firewall Policies attached at the Organization or Folder node.
Hierarchical firewall rules delegate or enforce rules top-down, taking precedence over project-level firewall rules.
4
Evaluate private cross-VPC service access mechanisms.
Selected Private Service Connect for publishing and consuming endpoints privately across administrative boundaries.
Private Service Connect avoids overlapping IP spaces and transitive routing risks inherent in traditional VPC Peering.

Key Concept

Google Cloud Perimeter Security & Network Isolation Controls
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic