Examkin

Soru

Zorluk: OrtaNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A financial services enterprise needs to establish a secure, private connection from workloads running in its Google Cloud VPC to a third-party software provider's managed API hosted in a separate Google Cloud organization. The security team mandates that communication must remain strictly within the Google Cloud backbone without exposing internal IP ranges or requiring VPC Network Peering. Additionally, the project hosting the enterprise workloads must prevent authorized users from exfiltrating data to unauthorized external resources outside the designated security boundary. Which architectural design fulfills all specified security and connectivity requirements?

  1. Provision a Private Service Connect (PSC) endpoint inside the consumer VPC pointing to the provider's Service Attachment, and place the consumer project inside a VPC Service Controls perimeter configured with an explicit egress rule allowing access to the target service.Cevap
  2. B
    Establish a VPC Network Peering connection between the consumer VPC and the service provider VPC, relying strictly on Cloud IAM roles to restrict data movement and prevent exfiltration to unapproved buckets.
  3. C
    Deploy an IPsec HA VPN tunnel between the consumer VPC and the third-party provider's network, and attach a Cloud Armor security policy to the egress gateway to inspect outbound Layer 7 traffic.
  4. D
    Enable Private Google Access on the consumer subnet, grant the Service Account Admin role to compute instances, and use standard default egress firewall rules to reach the external provider's endpoints.

Cevap

Provision a Private Service Connect (PSC) endpoint inside the consumer VPC pointing to the provider's Service Attachment, and place the consumer project inside a VPC Service Controls perimeter configured with an explicit egress rule allowing access to the target service.
The correct solution uses Private Service Connect to provide private, single-direction endpoint connectivity to the external service without exposing network topologies or requiring VPC peering. Combining this with VPC Service Controls protects against data exfiltration by locking down API egress while permitting explicitly configured egress rules to the trusted service attachment.

Adım Adım Çözüm

1
Analyze connectivity requirements across independent organization boundaries without IP range exposure.
Private Service Connect (PSC) allows private endpoint creation inside the consumer VPC to access published services in another organization via internal IP addresses without requiring VPC Peering.
VPC Peering exposes RFC 1918 subnets between organizations and requires non-overlapping IP space, whereas PSC abstracts the target service into an internal endpoint address.
2
Evaluate data exfiltration protection requirements.
VPC Service Controls (VPC SC) creates a secure perimeter around Google Cloud resources to prevent exfiltration even if IAM credentials are compromised or misused.
IAM grants access identity permission, but only VPC SC enforces spatial network boundaries preventing data copy operations to unauthorized external locations.
3
Synthesize perimeter security rules for permitted third-party service communication.
Configure a VPC SC perimeter with specific ingress and egress rules to allow traffic exclusively to the approved PSC service attachment and target project.
This guarantees that all other unauthorized egress data flows outside the perimeter remain blocked.

Anahtar Kavram

Combining Private Service Connect (PSC) with VPC Service Controls egress policies for secure multi-tenant service consumption and anti-exfiltration perimeter defense.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

Bu konudan daha fazla soru