Google Professional Cloud Security Engineer Question 254
Select 3Google Cloud PlatformYour organization uses Google Cloud to store sensitive financial data in BigQuery and Cloud Storage. You need to ensure that access to these resources is restricted to your internal network and trusted VPCs only, while also preventing data exfiltration to unauthorized locations or services. Which configuration steps should you take to implement VPC Service Controls for this use case?
- A
Define a service perimeter and include BigQuery and Cloud Storage as the protected services.
- B
Configure access levels to allow only internal IP ranges and trusted VPCs.
- C
Enable Private Google Access for VMs within the trusted VPCs.
- D
Grant the 'roles/editor' IAM role to all users needing access within the service perimeter.
- E
Add public IP ranges to the access level configuration to allow external access when necessary.
Show answer and explanation
Correct answers: A, B, C
Explanation
To secure sensitive data in Google Cloud using VPC Service Controls, it's essential to define a service perimeter around the relevant services (e.g., BigQuery and Cloud Storage) and configure access levels to restrict access to internal and trusted IP ranges. Enabling Private Google Access ensures that VMs in trusted VPCs can communicate with Google services securely. Avoid granting overly permissive roles or adding public IP ranges, as these actions can bypass the protections provided by VPC Service Controls.
- A. Correct.
Correct: Defining a service perimeter and including BigQuery and Cloud Storage ensures these services are protected by VPC Service Controls.
- B. Correct.
Correct: Configuring access levels to allow only internal IP ranges and trusted VPCs restricts access to resources within the service perimeter.
- C. Correct.
Correct: Enabling Private Google Access ensures VMs in the trusted VPCs can access Google APIs and services without exposing traffic to the public internet.
- D. Incorrect.
Incorrect: Granting the 'roles/editor' IAM role is overly permissive and does not align with the principle of least privilege, which is critical for securing sensitive data.
- E. Incorrect.
Incorrect: Adding public IP ranges to the access level configuration contradicts the goal of restricting access to internal networks and trusted VPCs.