Examkin

Soru

Zorluk: ZorNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A multinational genomics research institute processes sensitive sequencing data on Google Cloud across multiple projects. Project-Compute hosts a private Google Kubernetes Engine (GKE) cluster that runs analytical workloads, while Project-Data stores raw genomic files in Cloud Storage buckets. The security policy mandates that: 1) On-premises analyst workstations connected via Dedicated Interconnect must securely administer the GKE cluster master, 2) GKE workloads must read objects from Project-Data without routing over the public internet, and 3) Data exfiltration to external Cloud Storage buckets outside the organization must be strictly blocked, even if a compromised service account has IAM Storage Admin permissions. Which architectural design fulfills all of these security requirements?

  1. Place Project-Compute and Project-Data within a single VPC Service Controls perimeter, enforce GKE control plane authorized networks restricted to the on-premises subnet CIDR over Dedicated Interconnect, and use Private Service Connect endpoints for Cloud Storage access.Cevap
  2. B
    Configure fine-grained IAM conditional roles on Project-Data buckets restricted to the GKE service account identity, and establish VPC Network Peering between Project-Compute and Project-Data.
  3. C
    Establish VPC Network Peering between the on-premises transit VPC and Project-Compute VPC, assuming traffic will transitively route through Project-Compute to reach Cloud Storage in Project-Data.
  4. D
    Enable public endpoint access on the private GKE cluster while disabling authorized networks, and assign the primitive Owner role to the GKE nodes service account to bypass VPC Service Controls perimeter blocks.

Cevap

Place Project-Compute and Project-Data within a single VPC Service Controls perimeter, enforce GKE control plane authorized networks restricted to the on-premises subnet CIDR over Dedicated Interconnect, and use Private Service Connect endpoints for Cloud Storage access.
Placing both the compute and data projects inside a unified VPC Service Controls service perimeter prevents data exfiltration to external storage locations even if credentials are compromised. Restricting GKE control plane access via Authorized Networks ensures that cluster management can only occur over the Dedicated Interconnect from specified on-premises subnets.

Adım Adım Çözüm

1
Analyze data exfiltration requirements
Identified that IAM permissions alone cannot prevent data egress to external Google Cloud projects.
VPC Service Controls perimeters are required to isolate Google API resources and block exfiltration even for privileged IAM identities.
2
Evaluate private connectivity and GKE administration controls
Determined that GKE Control Plane Authorized Networks combined with Private Service Connect or Private Google Access via Interconnect satisfies private cluster management constraints.
Control plane authorized networks block unauthorized external IP ranges from reaching the GKE control plane endpoint, ensuring access is restricted to the on-premises CIDR over Dedicated Interconnect.
3
Synthesize perimeter security architecture
Combining both projects within a unified VPC Service Controls service perimeter alongside Private Service Connect and GKE Authorized Networks satisfies all security constraints.
This guarantees secure private access, restricted management routes, and perimeter-level exfiltration protection.

Anahtar Kavram

VPC Service Controls and Perimeter Access Security
Bu soruyu puanla

Konular

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

Bu konudan daha fazla soru