Examkin

Soru

Zorluk: OrtaNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A smart grid energy management enterprise processes telemetry data ingested from municipal power meters into BigQuery and Cloud Storage within Google Cloud. The security operations team requires that internal analysts operating inside a management Compute Engine Virtual Machine (VM) retain administrative access to run BigQuery queries. However, the architecture must strictly prevent authorized users or compromised service accounts from exfiltrating sensitive data to Cloud Storage buckets outside the organization's perimeter, even if their IAM identities have full object creation permissions. Which solution should a Cloud Architect implement to satisfy these security requirements?

  1. Establish a VPC Service Controls perimeter around the project hosting BigQuery and Cloud Storage to block API data movement outside the designated perimeter boundaries.Cevap
  2. B
    Rely on fine-grained IAM custom roles and IAM Conditions to restrict storage object creation actions exclusively to authorized bucket resource paths.
  3. C
    Connect the analyst VPC to a central network hub using VPC Network Peering and configure egress firewall rules on the transit VPC to filter external GCP API calls.
  4. D
    Assign primitive Viewer roles to analyst identities and configure GKE control plane authorized networks to block non-whitelisted IP addresses from accessing API endpoints.

Cevap

Establish a VPC Service Controls perimeter around the project hosting BigQuery and Cloud Storage to block API data movement outside the designated perimeter boundaries.
VPC Service Controls provide a perimeter boundary around Google Cloud services like BigQuery and Cloud Storage. By restricting API access to within the defined perimeter, it prevents data from being copied or exfiltrated to resources in external projects, regardless of the user's IAM permissions.

Adım Adım Çözüm

1
Analyze the core security requirement
The requirement demands preventing data exfiltration to unauthorized GCP resources by authorized users or compromised service accounts with valid IAM roles.
Standard IAM privileges permit authenticated identities to copy data to any storage bucket they can access unless constrained at the service perimeter level.
2
Evaluate Google Cloud perimeter security mechanisms
VPC Service Controls isolate Google Cloud service APIs (such as BigQuery and Cloud Storage) within defined security perimeters.
VPC Service Controls block unauthorized request paths and data transfers across perimeter borders even if IAM permissions allow the action.
3
Confirm the valid architectural solution
Placing the sensitive projects inside a VPC Service Controls perimeter prevents egress data movement to external storage locations.
VPC Service Controls are specifically designed to mitigate data exfiltration risks by enforcing perimeter controls directly on Google API endpoints.

Anahtar Kavram

VPC Service Controls data exfiltration prevention
Bu soruyu puanla

Konular

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

Bu konudan daha fazla soru