A financial enterprise processes sensitive market data across Compute Engine instances, BigQuery datasets, and Cloud Storage buckets within Google Cloud. A security review identifies two primary data exfiltration threats: A compromised internal workload or malicious insider using valid credentials to copy proprietary BigQuery analytical data to an external, unauthorized Google Cloud storage destination. An administrator inadvertently misconfiguring IAM policies on a Cloud Storage bucket, granting read access to external or public entities. Which perimeter security architecture should the cloud security engineer implement to mitigate both exfiltration vectors?

Configure a VPC Service Controls service perimeter enclosing the host projects, protect the BigQuery and Cloud Storage APIs within the perimeter, and route Google API requests through the restricted VIP.: ### What VPC Service Controls Is **VPC Service Controls** is a Google Cloud security capability that establishes context-based perimeter boundaries around Google-managed service resources and VPC networks. Rather than relying solely on identity authentication, it restricts API access and data movement strictly within defined **service perimeters**. ### How It Meets the Requirements - **Mitigating compromised insider exfiltration:** By enclosing BigQuery (`bigquery.googleapis.com`) and Cloud Storage (`storage.googleapis.com`) in the perimeter and utilizing the **restricted VIP** (`restricted.googleapis.com`), VPC Service Controls prevents commands (such as `bq mk` or `gcloud storage cp`) from moving or copying data from resources inside the perimeter to storage resources outside the perimeter, even when executed by authorized identities. - **Preventing public exposure from IAM misconfigurations:** Even if an administrator mistakenly grants broad or public IAM permissions (such as `allUsers` or `allAuthenticatedUsers`), VPC Service Controls intercepts and denies incoming requests originating from unauthorized external networks or contexts. ### Key Capabilities - **Bi-directional data protection:** Blocks unauthorized read and write operations across perimeter boundaries. - **Dual-layer defense in depth:** Complements IAM identity checks with strict network and context-aware boundary enforcement. - **Private API routing:** The **restricted VIP** directs requests to supported Google-managed services over internal Google network paths without internet exposure. - **Centralized governance:** Allows enforcement across an entire organization or delegated through **scoped access policies**. ### Why This Is Optimal Identity-based controls (IAM) cannot prevent a compromised authorized user from reading corporate data and writing it to an unmanaged external resource. VPC Service Controls explicitly enforces egress boundaries on Google-managed APIs, making it the only native solution designed specifically to stop this exfiltration vector.

Vpc Service Controls Data Exfiltration Mitigation 2 | Professional Cloud Security Engineer

Vpc Service Controls Data Exfiltration Mitigation 2

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise processes sensitive market data across Compute Engine instances, BigQuery datasets, and Cloud Storage buckets within Google Cloud. A security review identifies two primary data exfiltration threats:

A compromised internal workload or malicious insider using valid credentials to copy proprietary BigQuery analytical data to an external, unauthorized Google Cloud storage destination.
An administrator inadvertently misconfiguring IAM policies on a Cloud Storage bucket, granting read access to external or public entities.

Which perimeter security architecture should the cloud security engineer implement to mitigate both exfiltration vectors?

Define VPC firewall egress deny rules targeting destination 0.0.0.0/0 while allowing outbound traffic to default Google API public domains.

Enforce IAM Conditions to restrict user token lifespans and configure Cloud Audit Logs anomaly alerting in Security Command Center.

Configure Cloud Armor security policies with rate limiting and IP filtering rules on the load balancers serving internal VMs.

Configure a VPC Service Controls service perimeter enclosing the host projects, protect the BigQuery and Cloud Storage APIs within the perimeter, and route Google API requests through the restricted VIP.

Professional Cloud Security Engineer

Vpc Service Controls Data Exfiltration Mitigation 2

Related questions