Google Professional Cloud Network Engineer Question 20
Select 3Google Cloud PlatformYour organization is designing a new multi-tier application on Google Cloud. The application processes sensitive customer data and must comply with security policies preventing data exfiltration. The application communicates with external APIs and also stores data in a Cloud Storage bucket. How can you design the network to prevent unauthorized data exfiltration while ensuring the application functions correctly?
- A
Use VPC Service Controls to define service perimeters around your Cloud Storage bucket and external APIs.
- B
Configure egress firewall rules to allow traffic only to trusted external IP ranges.
- C
Enable Private Google Access and use Service Directory to route all external traffic through Google's private backbone.
- D
Implement Cloud Armor to block traffic from untrusted external IPs.
- E
Use Cloud NAT for outbound internet access and restrict egress traffic to specific destinations.
Show answer and explanation
Correct answers: A, B, E
Explanation
To prevent data exfiltration while ensuring the application functions correctly, you need to use a combination of tools. VPC Service Controls create secure perimeters for sensitive services like Cloud Storage. Egress firewall rules ensure that traffic only goes to trusted external IPs. Cloud NAT provides a secure way for resources without public IPs to access the internet while maintaining control over egress traffic. These measures together provide a robust design for secure data handling and exfiltration prevention.
- A. Correct.
VPC Service Controls help prevent unauthorized data exfiltration by creating service perimeters around Google Cloud services, ensuring that data cannot leave the defined perimeter.
- B. Correct.
Egress firewall rules can be configured to allow traffic only to specific trusted external IP ranges, which helps prevent unauthorized outbound connections and reduces the risk of data exfiltration.
- C. Incorrect.
Private Google Access is for accessing Google APIs and services privately from a VPC, but it does not inherently enforce data exfiltration prevention for external APIs or destinations.
- D. Incorrect.
Cloud Armor is designed for protecting applications from DDoS and other web attacks, but it is not directly used for preventing data exfiltration.
- E. Correct.
Cloud NAT enables outbound internet access for resources without assigning them external IPs, and it can be combined with restrictive egress rules to ensure traffic only goes to approved destinations.