Google Professional Cloud Security Engineer Question 138
Single answerGoogle Cloud PlatformYour organization has implemented Access Context Manager to regulate access to specific Google Cloud resources. You are tasked with ensuring that only employees working from the corporate office network or connected through the organization's VPN can access sensitive data stored in a Cloud Storage bucket. How should you configure Access Context Manager to achieve this?
- A
Create a new access level that includes the IP address ranges of the corporate office network and VPN, then associate this access level with the relevant service perimeter.
- B
Enable VPC Service Controls and restrict the Cloud Storage bucket access to the corporate office network.
- C
Add the IP address ranges of the corporate office network and VPN to the IAM policy of the Cloud Storage bucket.
- D
Create an organization policy that denies all non-corporate network IP addresses from accessing Cloud Storage.
Show answer and explanation
Correct answer: A
Explanation
Access Context Manager allows you to define access levels based on attributes such as IP address ranges, device security status, or user identity. To restrict access to sensitive resources based on the corporate office network and VPN IP ranges, you must create a custom access level with the appropriate IP ranges and associate it with a service perimeter. This ensures that only requests from these networks can access the Cloud Storage bucket.
- A. Correct.
Correct: You should create an access level in Access Context Manager that includes the IP address ranges of the corporate office network and VPN, and then associate it with a service perimeter. This ensures only requests from these trusted networks are allowed access to sensitive resources.
- B. Incorrect.
Incorrect: While VPC Service Controls can enhance security by defining service perimeters, they do not natively allow for specific IP-based access restrictions without using Access Context Manager.
- C. Incorrect.
Incorrect: IAM policies control permissions but do not provide IP-based access restrictions. Access Context Manager is specifically designed for this purpose.
- D. Incorrect.
Incorrect: Organization policies can enforce restrictions on resource usage or configurations, but IP-based access control for Cloud Storage is not one of their functions.