Examkin

Soru

Zorluk: Çok zorNetwork Security, Firewalls, Cloud Armor, and VPC Service Controls

A global healthcare enterprise is implementing a multi-tenant Google Cloud architecture across multiple organization folders. Central security governance requires that all Compute Engine instances bound to sensitive workloads with the tag key-value pair environment=restricted are subjected to mandatory security rules that cannot be overridden or modified by local project administrators. Furthermore, these workloads must access Google Cloud APIs (such as BigQuery) without allowing authorized users or compromised instances to exfiltrate data to unauthorized GCP projects or external buckets. Which architectural approach satisfies these security and perimeter requirements while preventing administrative overrides?

  1. Define central Hierarchical Firewall Policies at the folder level configured with Secure Tags, and construct a VPC Service Controls perimeter around the restricted project with explicit Egress Rules authorizing restricted API destinations.Cevap
  2. B
    Grant IAM Owner primitive roles to central security administrators while attaching fine-grained IAM Conditions to service accounts to restrict dataset access, relying on IAM permissions to prevent external bucket data copies.
  3. C
    Define standard VPC network firewall rules using legacy network tags in a central hub VPC, and route all restricted compute workload traffic through transitive VPC Network Peering connections to reach Google Cloud APIs.
  4. D
    Deploy Cloud NAT in each spoke VPC to obscure instance IP addresses, restrict egress via VPC network firewall rules, and grant primitive Editor roles to security teams for managing firewall rule priority across projects.

Cevap

The optimal solution is to define central Hierarchical Firewall Policies at the folder level enforced via Secure Tags, combined with a VPC Service Controls perimeter configured with explicit Egress Rules.
Hierarchical Firewall Policies enforce non-overridable security constraints from the folder level using Secure Tags, while VPC Service Controls isolate Google Cloud APIs inside a security perimeter to prevent data exfiltration.

Adım Adım Çözüm

1
Evaluate enforcement mechanism against administrative override.
Hierarchical Firewall Policies applied at the folder or organization level are evaluated before project-level VPC firewall rules and cannot be bypassed or modified by project-level IAM users.
Centralized governance requires immutable rule hierarchy across multi-tenant folders.
2
Select targeting mechanism for compute instances.
Secure Tags provide cryptographically secure, IAM-governed resource tagging linked directly to Resource Manager, avoiding the spoofing risks of legacy network tags.
Network tags can be altered by users with instance modification rights, whereas Secure Tags require specific IAM tag binding roles.
3
Address data exfiltration prevention requirement.
VPC Service Controls form a security perimeter around GCP services (like BigQuery), isolating network communication and blocking unauthorized data egress even from valid IAM identities.
IAM controls WHO can access resources, but VPC Service Controls govern FROM WHERE and TO WHERE data can flow.

Anahtar Kavram

Hierarchical Firewall Policies & VPC Service Controls Perimeter Security
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Network Security, Firewalls, Cloud Armor, and VPC Service Controls

Bu konudan daha fazla soru