Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ37

Securing communications and establishing boundary protection

A security team wants to implement a defense-in-depth strategy to protect sensitive data stored in a Cloud Storage bucket. The team has these requirements:

  • The Cloud Storage bucket in Project A must be readable only from Project B.
  • The Cloud Storage bucket in Project A must not be accessible from outside the network.
  • Data in the Cloud Storage bucket must not be copied to an external Cloud Storage bucket.

What should the security team do?

  • A Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.
  • B Enable VPC Service Controls, create a perimeter around Projects A and B, and include the Cloud Storage API in the Service Perimeter configuration.
  • C Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.
  • D Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.
Explanation

VPC Service Controls creates an enforced boundary for protected Google APIs and projects. Configuring a service perimeter containing Projects A and B and restricting the Cloud Storage API (storage.googleapis.com) keeps authorized access within that perimeter and blocks perimeter-crossing API requests, including copying Cloud Storage data to unauthorized resources outside the perimeter. IAM remains the mechanism for granting the intended reader permissions. VPC Service Controls overview and service perimeter configuration document that enforced perimeters deny boundary-crossing requests and mitigate data-exfiltration risks.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!