A financial enterprise is establishing a secure cloud development environment on Google Cloud to support sensitive application engineering workloads under strict regulatory compliance. The architecture must satisfy the following security specifications: Dedicated source code repositories must be provisioned using Secure Source Manager and isolated privately without exposing endpoints to the public internet. All repository data at rest must be encrypted with Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. Repository instances and development resources must be protected against data exfiltration by isolating the project within a VPC Service Controls perimeter. Which configuration steps should the DevOps engineer implement?

Provision a Private Service Connect Secure Source Manager instance encrypted with a regional Cloud KMS symmetric key, include the project in a VPC Service Controls service perimeter, and specify Secure Source Manager as a restricted service.: ### What the Solution Is This solution implements an enterprise-grade secure development environment by combining **Secure Source Manager**, **Private Service Connect (PSC)**, **Customer-Managed Encryption Keys (CMEK)**, and **VPC Service Controls (VPC SC)**. ### How It Meets the Requirements - **Private Network Connectivity:** Deploying Secure Source Manager with **Private Service Connect** ensures that all source repository communication occurs over private IP paths within Google Cloud's Software-Defined Network, completely eliminating public IP exposure. - **Regulatory Encryption (CMEK):** Utilizing regional symmetric keys in **Cloud KMS** to encrypt persistent repository storage grants full cryptographic ownership to the enterprise, ensuring compliance with standards such as FedRAMP High and HIPAA. - **Data Exfiltration Mitigation:** Adding the hosting project to a **VPC Service Controls service perimeter** and designating Secure Source Manager as a **restricted service** prevents unauthorized cross-boundary data transfers, API abuse, and external access. ### Key Advantages - **Zero Public Ingress:** PSC keeps repository endpoints entirely internal to the VPC. - **Granular Cryptographic Lifecycle:** Administrators can immediately disable or destroy the CMEK key to render repository contents inaccessible during security incidents. - **Perimeter-Enforced Boundary:** VPC Service Controls restricts Google Cloud API communications, ensuring that only trusted identities within authorized network perimeters can interact with the development environment. - **Compliance Assurance:** Satisfies strict regulatory requirements for sensitive data storage, identity-centric access control, and network isolation. ### Why This Is Optimal This architecture directly aligns with Google Cloud security best practices by implementing defense-in-depth across the network, storage, and identity layers.

Secure Development Environment Vpc Sc Cmek Psc | Professional Cloud DevOps Engineer

Secure Development Environment Vpc Sc Cmek Psc

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is establishing a secure cloud development environment on Google Cloud to support sensitive application engineering workloads under strict regulatory compliance. The architecture must satisfy the following security specifications:

Dedicated source code repositories must be provisioned using Secure Source Manager and isolated privately without exposing endpoints to the public internet.
All repository data at rest must be encrypted with Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS.
Repository instances and development resources must be protected against data exfiltration by isolating the project within a VPC Service Controls perimeter.

Which configuration steps should the DevOps engineer implement?

Provision Secure Source Manager with VPC Network Peering across spoke networks, configure client-side token encryption using Secret Manager, and attach an Access Context Manager basic access level that permits all public IP ranges.

Provision a Private Service Connect Secure Source Manager instance encrypted with a regional Cloud KMS symmetric key, include the project in a VPC Service Controls service perimeter, and specify Secure Source Manager as a restricted service.

Provision a public Secure Source Manager instance with TLS enforcement, enable Cloud KMS asymmetric key encryption at the organization level, and use hierarchical firewall rules to deny external IP ingress.

Deploy a Compute Engine bastion host with an external IP address, configure OS Login with 2-step verification, and assign the Cloud IDS Admin role to developer service accounts.

Professional Cloud DevOps Engineer

Secure Development Environment Vpc Sc Cmek Psc

Related questions