An organization hosts a data-processing workload on Compute Engine instances that have only internal RFC 1918 IP addresses and no access to the public internet. The application running on these instances needs to interact programmatically with BigQuery and Cloud Storage APIs to analyze and store sensitive corporate data. Security requirements dictate that: Compute Engine workloads must reach Google APIs securely without traversing the public internet or requiring external IP addresses. Data exfiltration must be strictly prevented, ensuring authorized service accounts cannot copy or export data to storage buckets or datasets residing in unauthorized external Google Cloud projects. Which combination of architectural controls should you implement to satisfy these requirements?

Enable Private Google Access on the subnet hosting the Compute Engine instances, and create a VPC Service Controls service perimeter enclosing the project and its BigQuery and Cloud Storage resources.: ### What Private Google Access and VPC Service Controls are **Private Google Access** allows virtual machine (VM) instances that have only internal (private) IP addresses to privately connect to the public IP addresses and endpoints of Google APIs and services without requiring external IPv4 addresses. **VPC Service Controls** allows security architects to define fine-grained security perimeters around Google Cloud resources (such as Cloud Storage and BigQuery) to isolate sensitive services and prevent unauthorized data egress across organizational boundaries. ### How it meets the requirements - **No external IPs / Internal connectivity**: Enabling **Private Google Access** on the subnet ensures VM instances without external IP addresses can route API calls to BigQuery and Cloud Storage over Google's internal network backbone without needing external IP addresses or NAT gateways. - **Preventing data exfiltration**: Placing the project and resources inside a **VPC Service Controls** perimeter ensures that even if credentials or service accounts are compromised, API calls attempting to move data to external buckets or BigQuery datasets outside the defined perimeter are blocked at the perimeter edge. ### Key advantages and capabilities - **Internal network routing**: Keeps all API communication strictly within Google's high-performance internal network infrastructure. - **Context-aware boundary defense**: Enforces perimeter boundaries independent of Identity and Access Management (IAM) permissions, mitigating insider threat and credential theft risks. - **Zero public internet exposure**: Completely removes the requirement for public IPv4 assignments or internet egress paths on compute instances interacting with Google APIs. - **Granular API restriction**: Restricts API calls to specified services like `bigquery.googleapis.com` and `storage.googleapis.com` within protected projects. ### Why this is optimal This approach directly addresses both network egress constraints and perimeter data exfiltration risks. IAM permissions govern identity-based authorization, while **Private Google Access** and **VPC Service Controls** provide the required network isolation and perimeter boundaries to stop data movement to untrusted external projects.

StudyCerts

Secure Google Api Access Private Google Access Vpc Sc | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Secure Google Api Access Private Google Access Vpc Sc

Section: Accessing Google API best practices

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization hosts a data-processing workload on Compute Engine instances that have only internal RFC 1918 IP addresses and no access to the public internet. The application running on these instances needs to interact programmatically with BigQuery and Cloud Storage APIs to analyze and store sensitive corporate data.

Security requirements dictate that:

Compute Engine workloads must reach Google APIs securely without traversing the public internet or requiring external IP addresses.
Data exfiltration must be strictly prevented, ensuring authorized service accounts cannot copy or export data to storage buckets or datasets residing in unauthorized external Google Cloud projects.

Which combination of architectural controls should you implement to satisfy these requirements?

Assign external IP addresses to all instances, enforce strict egress VPC firewall rules blocking non-Google IP ranges, and implement Customer-Managed Encryption Keys (CMEK).

Configure VPC Network Peering directly to the Google APIs VPC network, and enforce the Domain Restricted Sharing organization policy constraint on the organization.

Enable Private Google Access on the subnet hosting the Compute Engine instances, and create a VPC Service Controls service perimeter enclosing the project and its BigQuery and Cloud Storage resources.

Deploy Cloud NAT on the VPC network to provide outbound internet access for the instances, and configure Identity-Aware Proxy (IAP) on BigQuery and Cloud Storage.

Professional Cloud Architect

Secure Google Api Access Private Google Access Vpc Sc

Related questions