Google Professional Cloud Network Engineer Question 60
Select 4Google Cloud PlatformYou are designing a secure Google Cloud environment for your organization to manage access to sensitive data stored in BigQuery. The security team requires that data access be restricted to specific projects and only from within the corporate network. Which of the following steps should you take to implement VPC Service Controls to meet this requirement?
- A
Create a service perimeter and add the required projects to it.
- B
Configure ingress and egress rules for the service perimeter to restrict access to specific IP ranges.
- C
Enable Private Google Access for the subnets in your VPC.
- D
Grant the BigQuery Data Viewer role to all users in the organization.
- E
Define access levels using Access Context Manager with conditions based on IP address ranges.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To implement VPC Service Controls for securing sensitive data in BigQuery, you need to define a service perimeter around the required projects. Configuring ingress and egress rules ensures access is restricted to specific IP ranges. Enabling Private Google Access allows secure communication between your VPC and Google APIs. Additionally, defining access levels using Access Context Manager provides fine-grained control over who can access the resources based on specific conditions like IP ranges. Granting broad roles like BigQuery Data Viewer to all users violates the principle of least privilege and does not align with the security requirements.
- A. Correct.
Correct. Creating a service perimeter is a fundamental step in setting up VPC Service Controls to restrict access to sensitive data.
- B. Correct.
Correct. Configuring ingress and egress rules for the service perimeter ensures that access is limited to specific IP ranges, such as your corporate network.
- C. Correct.
Correct. Enabling Private Google Access is necessary for resources in the VPC to securely access Google APIs and services without using public IP addresses.
- D. Incorrect.
Incorrect. Granting the BigQuery Data Viewer role broadly to all users in the organization contradicts the security requirement to restrict access to sensitive data.
- E. Correct.
Correct. Defining access levels using Access Context Manager allows you to enforce additional conditions, such as IP address ranges, for accessing resources within the service perimeter.