Google Professional Cloud Network Engineer Question 58
Single answerGoogle Cloud PlatformYou are designing a secure data processing solution for your organization using Google Cloud. The solution involves multiple services, including Cloud Storage and BigQuery, that need to share sensitive data. The organization requires that data access is tightly controlled, and the data must not leave Google's network. Which design approach should you take to enforce these requirements?
- A
Enable VPC Service Controls and configure a service perimeter around the required services.
- B
Use Identity and Access Management (IAM) roles to restrict access to the services.
- C
Deploy all resources in a private Google Kubernetes Engine (GKE) cluster to ensure data security.
- D
Create firewall rules in the Virtual Private Cloud (VPC) to block external access to the services.
Show answer and explanation
Correct answer: A
Explanation
VPC Service Controls are designed to create service perimeters that enhance data security by restricting access to Google-managed services and preventing data exfiltration. This makes it the best choice for scenarios requiring tight control over sensitive data and ensuring it does not leave Google's network.
- A. Correct.
This is the correct approach. VPC Service Controls allow you to define a service perimeter to prevent data exfiltration and restrict access to Google-managed services to ensure data does not leave Google's network.
- B. Incorrect.
IAM roles control who can access resources but do not prevent data from leaving Google's network, making it insufficient for this scenario.
- C. Incorrect.
While deploying resources in a private GKE cluster can enhance security, it does not address data exfiltration risks or enforce perimeters on Google-managed services like Cloud Storage and BigQuery.
- D. Incorrect.
Firewall rules in a VPC can restrict network traffic but cannot enforce controls on Google-managed services or prevent data exfiltration.