A financial enterprise is designing a network architecture on Google Cloud to adhere to strict regulatory compliance standards for sensitive data workloads. The organization must meet the following security requirements: Prevent data exfiltration from Google-managed services (such as Cloud Storage and BigQuery) to unauthorized external storage resources or accounts. Ensure internal virtual machines (VMs) without external IP addresses access supported Google APIs exclusively over a private Google routing path. Restrict inbound HTTP(S) traffic to public-facing applications at the network edge based on source CIDR blocks and protect backends from direct internet exposure. Allow secure administrative SSH access to internal VMs without assigning public IP addresses or exposing port 22 directly to the public internet. Which combination of Google Cloud architectural controls should the enterprise implement?

Configure a VPC Service Controls perimeter enclosing the managed services and VPC networks, route Google API DNS queries to restricted.googleapis.com, attach Cloud Armor security policies to an external Application Load Balancer, and enable Identity-Aware Proxy (IAP) TCP forwarding for SSH access.: ### What the combined architecture is This architecture combines **VPC Service Controls**, **Private Google Access** via the `restricted.googleapis.com` virtual IP (VIP) address range, **Google Cloud Armor** edge security policies on an **external Application Load Balancer**, and **Identity-Aware Proxy (IAP) TCP forwarding** to form a layered defense-in-depth perimeter for regulatory compliance. ### How it meets all requirements - **Preventing data exfiltration:** Enclosing projects, VPC networks, and managed storage services (Cloud Storage, BigQuery) within a **VPC Service Controls service perimeter** prevents data copying to external resources or access from unauthorized perimeters. - **Private Google API communication:** Pointing the `*.googleapis.com` DNS zone to `restricted.googleapis.com` (which resolves to `199.36.153.4/30`) ensures that internal VMs communicate with supported Google APIs across private routes and blocks access to unmanaged public services. - **Edge filtering and backend isolation:** Attaching **Cloud Armor security policies** to the backend service of a global **external Application Load Balancer** enforces IP CIDR allowlists at Google Front Ends (GFEs) and pairs with VPC ingress firewall rules allowing only GFE IP ranges (`35.191.0.0/16`, `130.211.0.0/22`). - **Secure internal SSH management:** Using **Identity-Aware Proxy (IAP) TCP forwarding** allows administrators to establish encrypted SSH tunnels to internal RFC 1918 addresses over port `22` using Google-managed authentication without external IP addresses. ### Key advantages and capabilities - **Zero public IP footprint on backends:** Eliminates internet attack surfaces on backend Compute Engine instances. - **Boundary data loss prevention:** Enforces cryptographic and identity perimeter boundaries that IAM permissions alone cannot provide. - **Edge-level traffic inspection:** Drops unauthorized public application requests at the Google edge before consuming VPC network bandwidth. - **Context-aware administration:** Binds administrative SSH access to IAM identities and device context parameters. ### Why this is optimal This approach aligns with Google Cloud security best practices by implementing segmentation across all four critical planes: data API boundaries, private egress routing, public ingress edge inspection, and identity-aware management channels.

Design Network Segmentation Perimeter Controls Compliance | Professional Cloud Security Engineer

Design Network Segmentation Perimeter Controls Compliance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is designing a network architecture on Google Cloud to adhere to strict regulatory compliance standards for sensitive data workloads. The organization must meet the following security requirements:

Prevent data exfiltration from Google-managed services (such as Cloud Storage and BigQuery) to unauthorized external storage resources or accounts.
Ensure internal virtual machines (VMs) without external IP addresses access supported Google APIs exclusively over a private Google routing path.
Restrict inbound HTTP(S) traffic to public-facing applications at the network edge based on source CIDR blocks and protect backends from direct internet exposure.
Allow secure administrative SSH access to internal VMs without assigning public IP addresses or exposing port 22 directly to the public internet.

Which combination of Google Cloud architectural controls should the enterprise implement?

Set up a dry-run VPC Service Controls perimeter, create Private Service Connect endpoints for third-party SaaS APIs, configure Cloud Armor network DDoS policies in preview mode, and disable serial console access across all VM instances.

Deploy a single-NIC Network Virtual Appliance (NVA) NAT proxy for all outbound traffic, configure DNS to resolve to private.googleapis.com, attach Cloud Armor policies directly to backend VMs, and configure a public bastion host VM for SSH hopping.

Configure a VPC Service Controls perimeter enclosing the managed services and VPC networks, route Google API DNS queries to restricted.googleapis.com, attach Cloud Armor security policies to an external Application Load Balancer, and enable Identity-Aware Proxy (IAP) TCP forwarding for SSH access.

Enforce the compute.skipDefaultNetworkCreation organization policy constraint, configure Cloud NAT for Google API egress, attach hierarchical firewall policies to allow 0.0.0.0/0 on port 22, and attach edge security policies to internal TCP/UDP load balancers.

Professional Cloud Security Engineer

Design Network Segmentation Perimeter Controls Compliance

Related questions