Google Professional Cloud Security Engineer Question 253
Select 3Google Cloud PlatformYour organization manages sensitive customer data stored in BigQuery, and you need to ensure that this data is not accessed from outside your organization's infrastructure. You are also required to enforce controls on APIs to prevent data exfiltration. Which steps should you take to achieve this using VPC Service Controls?
- A
Create a service perimeter and include the BigQuery API as a restricted service.
- B
Configure an ingress rule to allow access to the BigQuery API from any external IP address.
- C
Enable logging for VPC Service Controls to monitor denied access attempts.
- D
Add the required Google Cloud projects to the service perimeter.
- E
Configure egress rules to allow the BigQuery API to send data to external storage systems.
Show answer and explanation
Correct answers: A, C, D
Explanation
To protect sensitive data using VPC Service Controls, you must create a service perimeter and include the required APIs as restricted services. Adding the appropriate projects to the perimeter ensures that the resources within those projects are protected. Enabling logging allows you to monitor access attempts and maintain visibility. Configuring ingress or egress rules that allow external access would compromise the security of the service perimeter.
- A. Correct.
Correct: Creating a service perimeter and including the BigQuery API ensures that access to BigQuery is restricted to resources within the defined perimeter.
- B. Incorrect.
Incorrect: Allowing access from any external IP address defeats the purpose of using VPC Service Controls to restrict access.
- C. Correct.
Correct: Enabling logging for VPC Service Controls helps to monitor and audit denied access attempts, which is critical for maintaining security.
- D. Correct.
Correct: Adding the required Google Cloud projects to the service perimeter ensures that the resources within those projects are protected by the perimeter.
- E. Incorrect.
Incorrect: Configuring egress rules to send data to external storage systems can create potential pathways for data exfiltration, which goes against the goal of securing the data.