Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A enterprise media streaming company enforces strict data exfiltration controls by placing its core analytical datasets in BigQuery inside a restricted VPC Service Controls perimeter in Project-Data. Data scientists access BigQuery programmatically from compute instances located in a separate management VPC network in Project-Workloads via a Private Service Connect (PSC) endpoint. Despite assigning the required IAM BigQuery Data Viewer roles to the service account, queries routed through the PSC endpoint fail with a VPC Service Controls perimeter violation error. How should the principal cloud architect resolve this issue while maintaining perimeter security boundaries?

  1. Configure an ingress rule on the VPC Service Controls perimeter in Project-Data specifying the identity of the service account and the source project context of Project-Workloads.Answer
  2. B
    Establish a VPC Network Peering connection between Project-Workloads and Project-Data to bridge the network boundaries and bypass perimeter validation.
  3. C
    Grant the primitive Owner role to the compute instance service account at the organization node level to override perimeter access restrictions.
  4. D
    Add the subnet CIDR range of Project-Workloads to the GKE control plane authorized networks list inside Project-Data.

Answer

Configure an ingress rule on the VPC Service Controls perimeter specifying the service account identity and source project context.
VPC Service Controls protect GCP APIs within a defined security perimeter. When requests originate from outside the perimeter—even when routed over a Private Service Connect endpoint—VPC Service Controls block the request by default unless an ingress policy is configured. Creating an ingress rule that specifies the caller service account and source project context permits access for that authorized workflow without disabling exfiltration protection.

Step-by-Step Solution

1
Identify the cause of access failure across project boundaries.
The failure occurs because BigQuery resides inside a VPC Service Controls perimeter in Project-Data, while API calls originate from Project-Workloads across a Private Service Connect endpoint.
VPC Service Controls enforce perimeter boundaries at the GCP API layer regardless of whether traffic arrives over public endpoints or Private Service Connect.
2
Evaluate perimeter cross-boundary access requirements.
To allow external clients to access perimeter-protected services, VPC Service Controls ingress rules must explicitly define authorized attributes.
Ingress rules define allowed caller identities (service accounts/users), source projects/networks, and target services without compromising perimeter isolation for unauthorized clients.
3
Select the appropriate security policy configuration.
An ingress rule referencing the service account identity and source project context allows private access securely.
This maintains data exfiltration protections while enabling authorized cross-perimeter API requests.

Key Concept

VPC Service Controls Ingress/Egress Rules for Private Service Connect
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic