Google Professional Cloud Network Engineer Question 16
Select 2Google Cloud PlatformYou are designing a hybrid cloud architecture for a financial services company that needs to ensure sensitive customer data remains secure and prevent data exfiltration. The company plans to use Google Cloud for its analytics workloads and connect its on-premises data center to Google Cloud using a VPN. Which of the following actions should you take to meet the security and data exfiltration prevention requirements?
- A
Implement VPC Service Controls to define perimeters around sensitive resources in Google Cloud.
- B
Use Private Google Access to ensure Google Cloud resources can communicate with Google APIs without public IPs.
- C
Enable Cloud Armor to block incoming traffic from untrusted IP addresses.
- D
Set up a firewall rule to block all egress traffic from the VPC except for the VPN connection.
- E
Enable Flow Logs on the subnet to monitor traffic leaving the VPC.
Show answer and explanation
Correct answers: A, D
Explanation
To prevent data exfiltration and ensure security in a hybrid cloud setup, it is important to restrict unauthorized access to sensitive resources and control outbound traffic. VPC Service Controls establish security perimeters that can block data exfiltration, while egress firewall rules restricting traffic to only the VPN ensure that data cannot leave the VPC through unauthorized channels.
- A. Correct.
Implementing VPC Service Controls helps create security perimeters around sensitive resources, preventing unauthorized data exfiltration. This is crucial for compliance and protecting sensitive customer data.
- B. Incorrect.
Private Google Access allows private communication with Google APIs but does not directly address the prevention of data exfiltration.
- C. Incorrect.
Cloud Armor is used for protecting applications from external threats such as DDoS attacks, but it is not relevant for blocking data exfiltration in this scenario.
- D. Correct.
Blocking all egress traffic except for the VPN ensures that sensitive data can only be sent through the controlled VPN connection, reducing the risk of data exfiltration.
- E. Incorrect.
Enabling Flow Logs helps monitor traffic but does not actively prevent data exfiltration. It is a monitoring tool, not a preventative measure.