Examkin

Question

Difficulty: HardNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

An online retail enterprise processes customer transaction data using backend microservices running on Google Cloud, storing the raw logs in BigQuery. The security team mandates two critical protections: first, authorized application service accounts must be strictly prevented from copying or exfiltrating BigQuery data to external, unauthorized Google Cloud projects; second, the public HTTPS entry point must be guarded against web application attacks, such as SQL injection, and volumetric rate abuses. Which TWO architectural controls should the Cloud Architect implement to satisfy these security requirements?

  1. Establish a VPC Service Controls service perimeter that encompasses both the application and BigQuery projects, specifying the BigQuery API as a restricted service.Answer
  2. Deploy Cloud Armor security policies configured with preconfigured WAF rule sets and rate limiting attached to the Global External HTTP(S) Load Balancer backend services.Answer
  3. C
    Grant the primitive Editor role to application service accounts and configure IAM conditions to restrict access exclusively to internal bucket paths.
  4. D
    Configure VPC Network Peering between the application VPC network and a dedicated security partner VPC network to transitively route all BigQuery API requests through a central virtual security appliance.

Answer

The correct controls are establishing a VPC Service Controls service perimeter enclosing the application and BigQuery projects, and deploying Cloud Armor security policies on the Global External HTTP(S) Load Balancer backend services.
The solution requires a combination of perimeter data exfiltration defense and edge application filtering. Enclosing the application and BigQuery projects within a VPC Service Controls perimeter prevents data exfiltration across boundaries to unauthorized Google Cloud resources. Concurrently, Cloud Armor policies attached to the external HTTP(S) load balancer provide web application firewall capabilities and rate limiting against Layer 7 attacks.

Step-by-Step Solution

1
Evaluate data exfiltration prevention requirements for Google Cloud APIs (BigQuery).
Identify that IAM permissions alone cannot prevent data movement to external projects, requiring network-level service perimeters.
VPC Service Controls blocks requests to restricted services (like BigQuery API) if the communication crosses the perimeter boundary, mitigating data exfiltration risks.
2
Evaluate Layer 7 web security and DDoS/rate-limiting requirements for the public endpoint.
Select Google Cloud Armor integrated with the Global External HTTP(S) Load Balancer.
Cloud Armor operates at the Google Cloud network edge, filtering malicious Layer 7 traffic and enforcing rate limits before requests hit backend application resources.
3
Analyze why alternate networking options fail.
Reject VPC Network Peering for routing API traffic through central appliances due to non-transitivity, and reject primitive IAM roles as insecure.
VPC Network Peering does not forward packets beyond the direct peer link (no transitivity), and primitive roles grant excess permissions.

Key Concept

Perimeter security using VPC Service Controls for exfiltration prevention and Cloud Armor edge policies for Layer 7 load balancer protection.
Rate this question

Topics

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

More questions from this topic