Google Professional Cloud Network Engineer Question 59
Select 3Google Cloud PlatformYour organization uses Google Cloud to store sensitive customer data in Cloud Storage. To ensure compliance and prevent data exfiltration, you have been tasked with implementing VPC Service Controls. Which of the following actions should you take to design and enforce a secure boundary for this use case?
- A
Create a service perimeter including the Cloud Storage API and add the relevant VPC networks to the perimeter.
- B
Disable all egress firewall rules in the VPC to prevent data from leaving the network.
- C
Configure access levels in the service perimeter to allow restricted access based on user attributes, such as IP address or device.
- D
Enable Private Google Access for subnets within the VPC to ensure services can be accessed securely without public IPs.
- E
Create a Cloud Storage bucket policy to explicitly deny access from any source outside your VPC.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure sensitive customer data in Cloud Storage using VPC Service Controls, you should create a service perimeter around the Cloud Storage API and your VPC networks. Additionally, configuring access levels allows you to apply further restrictions based on user attributes, and enabling Private Google Access ensures secure communication with Google APIs. Disabling all egress firewall rules or relying solely on bucket policies does not align with the design principles of VPC Service Controls.
- A. Correct.
Correct: Creating a service perimeter with the Cloud Storage API and adding the relevant VPC networks is a core step when implementing VPC Service Controls. This ensures that only traffic from within the perimeter can access the protected services.
- B. Incorrect.
Incorrect: Disabling all egress firewall rules is not required and could disrupt other legitimate traffic. VPC Service Controls already provide a mechanism to restrict unauthorized access.
- C. Correct.
Correct: Configuring access levels allows for additional fine-grained control, such as restricting access based on user attributes, which aligns with secure boundary design.
- D. Correct.
Correct: Enabling Private Google Access ensures that resources in the VPC can securely communicate with Google APIs, including those protected by VPC Service Controls, without requiring public IP addresses.
- E. Incorrect.
Incorrect: Bucket policies are not sufficient to enforce the same level of security and compliance as VPC Service Controls. VPC Service Controls provide a broader and more robust solution for securing data.