Google Professional Cloud Security Engineer Question 255
Select 2Google Cloud PlatformYour organization wants to restrict access to sensitive data stored in BigQuery, Cloud Storage, and Cloud Spanner to specific trusted networks. Additionally, the organization wants to ensure that any access to these resources is tightly controlled and cannot be accessed from unauthorized locations, even if proper credentials are used. Which of the following steps should you take to achieve this?
- A
Configure VPC Service Controls perimeter to include BigQuery, Cloud Storage, and Cloud Spanner as the protected resources.
- B
Set up IAM roles to restrict access to BigQuery, Cloud Storage, and Cloud Spanner only to authorized users.
- C
Create an access level in Access Context Manager to define trusted networks and associate it with the VPC Service Controls perimeter.
- D
Enable Private Google Access for all VPCs that need to access BigQuery, Cloud Storage, and Cloud Spanner.
- E
Update firewall rules in the VPC to block traffic from unauthorized IP addresses.
Show answer and explanation
Correct answers: A, C
Explanation
To restrict access to sensitive resources like BigQuery, Cloud Storage, and Cloud Spanner to specific networks, you need to configure a VPC Service Controls perimeter. Additionally, defining trusted networks using Access Context Manager ensures that only traffic from authorized locations can access these resources. IAM roles and firewall rules are complementary but do not provide the resource-level and network-based controls offered by VPC Service Controls.
- A. Correct.
Correct. Configuring a VPC Service Controls perimeter ensures that sensitive resources like BigQuery, Cloud Storage, and Cloud Spanner are protected and cannot be accessed from outside the defined perimeter.
- B. Incorrect.
Incorrect. While IAM roles are necessary for user-level access control, they do not restrict access based on network location or prevent access from unauthorized locations when credentials are compromised.
- C. Correct.
Correct. Creating access levels in Access Context Manager allows you to define trusted networks, which is a key component in setting up the VPC Service Controls perimeter for network-based restrictions.
- D. Incorrect.
Incorrect. Enabling Private Google Access allows instances in a VPC to access Google APIs privately, but it does not enforce security perimeters or restrict access based on trusted networks.
- E. Incorrect.
Incorrect. Firewall rules control traffic at the network level but do not integrate with VPC Service Controls or provide resource-level protection for managed services like BigQuery, Cloud Storage, and Cloud Spanner.