Google Professional Cloud Security Engineer Question 256
Select 3Google Cloud PlatformYour organization handles sensitive healthcare data that must comply with strict regulatory requirements. You are tasked with preventing data exfiltration from Google Cloud Storage buckets that contain this sensitive data. After consulting with the compliance team, you decide to implement VPC Service Controls to secure the environment. Which steps should you take to configure and enforce VPC Service Controls for this use case?
- A
Define a service perimeter that includes the required Google Cloud projects containing the sensitive data.
- B
Assign a public IP address to the Compute Engine instances accessing the sensitive data to ensure traceability.
- C
Add Google Cloud Storage as a restricted service within the service perimeter.
- D
Configure access levels to restrict access to the perimeter based on the identity and location requirements.
- E
Disable all network egress rules for the VPC to block all external network traffic.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure sensitive data with VPC Service Controls, you need to define a service perimeter that encompasses the Google Cloud projects containing the data. Adding Google Cloud Storage as a restricted service ensures that the perimeter applies to this service. Configuring access levels allows you to enforce restrictions based on identity and location, aligning with compliance requirements. Steps such as assigning public IPs or disabling all network egress traffic are either unnecessary or overly restrictive and do not directly contribute to the goal of preventing data exfiltration.
- A. Correct.
Correct: Defining a service perimeter is the first step in configuring VPC Service Controls. It specifies the Google Cloud projects that will be protected by the service perimeter.
- B. Incorrect.
Incorrect: Assigning a public IP to Compute Engine instances is unnecessary and does not align with securing sensitive data in this scenario. Public IPs can increase the risk of exposure.
- C. Correct.
Correct: Adding Google Cloud Storage as a restricted service ensures that the service perimeter enforces access restrictions on the data stored in Google Cloud Storage.
- D. Correct.
Correct: Configuring access levels provides granular control over who can access resources within the perimeter based on identity and location, which is critical for regulatory compliance.
- E. Incorrect.
Incorrect: Disabling all network egress rules for the VPC is excessive and can block legitimate traffic. VPC Service Controls are designed to secure data without completely disabling network traffic.