Google Professional Cloud Security Engineer Question 236
Select 3Google Cloud PlatformYour organization has multiple Google Cloud projects and wants to ensure that communication between applications in different projects is restricted to specific services. Which of the following configurations would achieve boundary segmentation while ensuring minimal operational overhead?
- A
Use Shared VPCs to centralize networking across projects and apply firewall rules to control inter-project communication.
- B
Implement VPC Service Controls to define service perimeters and restrict data exfiltration between projects.
- C
Use Cloud VPN to create encrypted tunnels between the projects, and configure IAM policies for resource access.
- D
Apply hierarchical firewall policies at the folder or organization level to enforce consistent network traffic restrictions across projects.
- E
Enable Private Google Access to ensure private communication between Google-managed services and projects.
Show answer and explanation
Correct answers: A, B, D
Explanation
Boundary segmentation in Google Cloud involves using tools and configurations that allow secure and controlled communication between different projects or environments. Shared VPCs help centralize networking resources and enforce firewall rules, while VPC Service Controls can define stricter service perimeters to prevent unauthorized data transfer. Hierarchical firewall policies provide an effective way to enforce consistent restrictions at a broader scope, making them a suitable option for this scenario. Cloud VPN and Private Google Access, while useful in other contexts, do not align well with the goal of segmenting boundaries between projects.
- A. Correct.
Using Shared VPCs allows you to centralize networking resources across projects and enforce firewall rules for inter-project communication, which can achieve boundary segmentation effectively.
- B. Correct.
VPC Service Controls help define boundaries for sensitive data by creating service perimeters, which are particularly useful for restricting data exfiltration and ensuring secure communication across projects.
- C. Incorrect.
Cloud VPN is primarily used for secure communication between on-premises and cloud environments or for connecting isolated networks. It adds unnecessary complexity for inter-project boundary segmentation.
- D. Correct.
Hierarchical firewall policies applied at the folder or organization level provide a scalable way to enforce consistent traffic restrictions across multiple projects, ensuring boundary segmentation.
- E. Incorrect.
Private Google Access ensures private communication between resources and Google APIs but does not address boundary segmentation for communication between projects.