Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ222

Designing for security and compliance

Your company has a Google Cloud project that uses BigQuery for data warehousing. The VPN tunnel between the on-premises environment and Google Cloud is configured with Cloud VPN. Your security team wants to prevent data exfiltration by malicious insiders, compromised code, and accidental oversharing. What should you do?

  • A Configure Private Service Connect.
  • B Configure VPC Service Controls and configure Private Google Access for on-promises hosts.
  • C Create a service account, grant the BigQuery JobUser role and Storage Object Viewer role to the service account, and remove all other Identity and Access Management (IAM) access from the project.
  • D Configure Private Google Access.
Explanation

VPC Service Controls creates a security perimeter around BigQuery and other supported Google Cloud services, limiting unauthorized data access and egress even when an identity otherwise has IAM permissions. Private Google Access for on-premises hosts lets hosts connected through Cloud VPN access protected Google APIs through the VPC; using it with the service perimeter supports secure private access from the on-premises environment.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!