Examkin

Question

Difficulty: Very hardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An enterprise Cloud Architect is designing perimeter security controls for a multi-tenant Google Cloud architecture. Match each enterprise security requirement on the left with the most appropriate Google Cloud perimeter control mechanism on the right.

  • Prevent an authorized internal identity in a VPC from copying BigQuery dataset contents to an unapproved, external Google Cloud project storage location.VPC Service Controls perimeters configured with explicit Egress Rules and Restricted Google APIs service boundaries.
  • Mitigate Layer 7 credential-stuffing attacks targeting a public Global External HTTP(S) Load Balancer by dynamically throttling clients exceeding request thresholds.Cloud Armor security policy enforcing rate-limiting rules and client IP HTTP request throttling at the edge.
  • Enforce organization-wide ingress traffic rules across multiple Shared VPC networks using dynamic, IAM-bound workload identity metadata rather than IP ranges.Hierarchical firewall policies integrated with Secure Tags bound to Resource Manager tags.
  • Provide on-premises workloads private access to a third-party managed SaaS service hosted in a producer VPC without configuring transitive VPC Peering.Private Service Connect (PSC) endpoint deployed inside the consumer VPC forwarding traffic over Cloud Interconnect.

Answer

Each enterprise security requirement maps directly to its designated perimeter control: Data exfiltration prevention matches VPC Service Controls; Layer 7 rate limiting matches Cloud Armor edge security policies; dynamic organization-wide firewall rule enforcement matches Hierarchical firewall policies with Secure Tags; and non-transitive private SaaS connection matches Private Service Connect.
The correct alignment maps each specific architectural risk to its appropriate defense mechanism: VPC Service Controls for exfiltration boundary defense, Cloud Armor for L7 edge protection, Hierarchical Firewalls with Secure Tags for organization-wide metadata-driven filtering, and Private Service Connect for non-transitive endpoint access.

Step-by-Step Solution

1
Analyze data exfiltration vector
Identify that IAM permissions alone cannot stop authorized users from writing to external resources, requiring a security perimeter control.
VPC Service Controls restrict API communication between managed services and external projects outside the perimeter.
2
Evaluate application-layer threat mitigation
Determine the edge protection mechanism for HTTP(S) Load Balancer traffic.
Cloud Armor inspects incoming web traffic at the global edge and enforces threshold-based rate limiting.
3
Assess dynamic network access policy across organization hierarchy
Select hierarchical policies with IAM-bound identity tags.
Hierarchical firewall rules combined with Secure Tags enforce consistent security postures at the organization level without IP static dependencies.
4
Review multi-tenant private connectivity options
Choose Private Service Connect for service endpoint publishing and consumption across network boundaries.
Private Service Connect bypasses transitive routing restrictions associated with VPC Network Peering and isolates tenant networks.

Key Concept

GCP Network Security & Perimeter Controls
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic