Professional Cloud Security EngineerDemo

Question

You are on a security team that needs to ensure a Cloud Storage bucket in Project A is readable only from Project B. You also need to ensure that data in the Cloud Storage bucket cannot be accessed from, or copied to, Cloud Storage buckets outside the network, even when the user has the correct credentials.

What should you do?

A Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service.
B Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket.
C Enable Private Access in Project A and B networks with strict firewall rules to allow communication between the networks.
D Enable VPC Peering between Project A and B networks with strict firewall rules to allow communication between the networks.

Explanation

VPC Service Controls enforces a service perimeter that provides a defense layer independent of IAM, controlling Cloud Storage data movement across the perimeter. With Project A and Project B in the same perimeter and the Cloud Storage service protected, reads and bucket-to-bucket copies can occur inside the perimeter, while access and copies involving Cloud Storage resources outside the perimeter are denied even to principals with otherwise-valid credentials.

Learn more

Professional Cloud Security EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ174

Community Discussion