An airline company is modernizing its flight operations architecture on Google Cloud. Match each enterprise perimeter security requirement on the left with the correct Google Cloud security mechanism on the right that fulfills it.
- Prevent data exfiltration from BigQuery and Cloud Storage to unauthorized external services by enforcing an API boundary.VPC Service Controls
- Filter incoming HTTP(S) web traffic at the global edge against SQL injection, cross-site scripting, and volumetric rate limits.Google Cloud Armor Security Policy
- Enforce organization-wide network ingress and egress policies across all existing and future VPC networks, overriding project-level firewall rules.Hierarchical Firewall Policy
- Connect securely and privately to a third-party partner API published in another VPC without exposing internal IP ranges or establishing VPC peering.Private Service Connect Endpoint
Cevap
The enterprise security requirements match as follows: Data exfiltration prevention for GCP APIs maps to VPC Service Controls; Edge HTTP(S) layer 7 protection maps to Google Cloud Armor Security Policy; Mandatory top-down network rule enforcement maps to Hierarchical Firewall Policy; Private non-transitive partner service access maps to Private Service Connect Endpoint.
Each Google Cloud perimeter security mechanism targets a distinct operational boundary: VPC Service Controls secure API-level communication for managed services; Cloud Armor delivers Layer 7 WAF and rate limiting at the load balancer edge; Hierarchical Firewall Policies enforce immutable organization-wide IP/port filtering; Private Service Connect provides targeted, non-transitive endpoint connectivity between separate VPC environments.
Adım Adım Çözüm
Anahtar Kavram
Designing multi-layered network perimeters using VPC Service Controls, Cloud Armor, Hierarchical Firewalls, and Private Service Connect.
Tahmini Süre:1m 30s