Google Professional Cloud Security Engineer Question 257
Select 3Google Cloud PlatformYour organization wants to prevent sensitive data stored in BigQuery from being exfiltrated to unauthorized locations. You have been tasked to set up VPC Service Controls to address this use case. What steps should you take to configure VPC Service Controls correctly?
- A
Create a service perimeter and include the BigQuery service and the project containing your BigQuery datasets.
- B
Enable private Google access on all VM instances within the VPC network.
- C
Add the appropriate users to the service perimeter access list to allow access to BigQuery data.
- D
Configure an access level policy to grant access based on IP ranges and identities.
- E
Set up firewall rules to block all egress traffic from the VPC network.
Show answer and explanation
Correct answers: A, C, D
Explanation
VPC Service Controls are designed to prevent data exfiltration by creating service perimeters around your Google Cloud resources. To configure this effectively for BigQuery, you need to create a service perimeter, include the BigQuery service, and define precise access controls using access levels and user access lists. Additionally, ensuring proper access levels helps enforce policies that align with your organization's security requirements. Firewall rules, while useful for network traffic control, do not address the data exfiltration risks that VPC Service Controls are designed to mitigate.
- A. Correct.
Correct. Creating a service perimeter and including the BigQuery service ensures that access to your BigQuery data is restricted to authorized resources and accounts within the perimeter.
- B. Incorrect.
Incorrect. Enabling private Google access is not directly related to VPC Service Controls; it is instead used to allow VM instances in the VPC to access Google APIs without using public IPs.
- C. Correct.
Correct. Adding users to the service perimeter access list ensures that only authorized identities can access resources protected by the VPC Service Controls perimeter.
- D. Correct.
Correct. Configuring access levels allows you to enforce policies based on conditions like IP ranges or identity attributes, adding an additional layer of control.
- E. Incorrect.
Incorrect. While firewall rules can restrict traffic, they are not part of VPC Service Controls and do not address data exfiltration risks specific to Google Cloud services like BigQuery.