Examkin

Question

Difficulty: MediumNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A financial services organization hosts sensitive client datasets in Cloud Storage and BigQuery within Google Cloud. The security team must ensure that authorized analysts working from an on-premises network can access these Google Cloud APIs over a Dedicated Interconnect connection, while preventing any authorized user from exfiltrating data to external Cloud Storage buckets outside the organization's control. IAM roles have already been restricted using custom fine-grained permissions. Which security control strategy should you implement to satisfy these perimeter security and exfiltration requirements?

  1. Configure a VPC Service Controls perimeter encompassing the Cloud Storage and BigQuery projects, and define ingress rules allowing API requests from the designated on-premises IP range over Private Google Access.Answer
  2. B
    Rely on the existing fine-grained IAM custom roles and remove public IP addresses from all Compute Engine virtual machines in the project network.
  3. C
    Establish VPC Network Peering between the analyst workstation VPC and a central transit VPC, relying on transitive routing across the peering connections to reach Google API endpoints.
  4. D
    Assign the primitive Viewer IAM role to all analyst accounts across the storage buckets to restrict actions to read-only operations.

Answer

Configure a VPC Service Controls perimeter encompassing the Cloud Storage and BigQuery projects, and define ingress rules allowing API requests from the designated on-premises IP range over Private Google Access.
The correct strategy is to construct a VPC Service Controls perimeter around the storage and analytical projects while utilizing ingress policies to grant access to the specified on-premises network range over Private Google Access. VPC Service Controls effectively mitigates data exfiltration risks by constraining Google API interactions to defined boundaries, even if an authorized user attempts to copy data to external storage targets.

Step-by-Step Solution

1
Identify the data exfiltration risk and perimeter requirement
Recognize that IAM controls alone cannot stop an authorized identity from exfiltrating data to an external, unauthorized GCP resource.
VPC Service Controls is specifically designed to restrict API communication boundaries and prevent data egress to untrusted GCP projects.
2
Select the proper perimeter security technology
Place the target BigQuery and Cloud Storage projects inside a VPC Service Controls service perimeter.
This isolates the Google APIs at the network boundary level regardless of IAM privileges.
3
Configure hybrid access into the perimeter
Use ingress rules and Private Google Access over Dedicated Interconnect to allow authorized on-premises traffic.
Ingress rules explicitly permit incoming network calls matching specified context attributes (such as IP range or identity) across hybrid connections.

Key Concept

VPC Service Controls and Hybrid Perimeter Ingress
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic