An enterprise stores proprietary financial analytics data inside private Cloud Storage buckets located in a dedicated project. The organization has two key security requirements: Prevent data exfiltration risks, such as unauthorized users or compromised credentials attempting to copy sensitive data to external Cloud Storage buckets outside organizational boundaries. Provide external auditing firms with temporary, time-limited access to specific financial datasets without creating dedicated Google Workspace or Cloud Identity accounts for external users. Which architectural strategy should you implement to satisfy both requirements?

Enclose the Cloud Storage project within a VPC Service Controls service perimeter, and generate Signed URLs with short expiration times for external auditors to access specific objects.: What VPC Service Controls and Signed URLs Are VPC Service Controls allows organizations to create secure network and service perimeters around sensitive Google Cloud resources, such as Cloud Storage, preventing multi-tenant service communication from crossing perimeter boundaries. Signed URLs provide time-limited, cryptographically signed access to specific Cloud Storage objects without requiring the recipient to possess Google Cloud Identity credentials or direct Identity and Access Management (IAM) roles. How It Meets the Requirements Exfiltration Prevention: Placing the storage project within a VPC Service Controls perimeter guarantees that Cloud Storage APIs are shielded at the network layer. Even if an insider obtains valid credentials, VPC Service Controls blocks requests attempting to transfer or copy data to unmanaged storage buckets outside the designated perimeter. Temporary External Access: Generating Signed URLs allows external auditors to perform HTTP GET requests against designated files for a predetermined lifespan (e.g., 60 minutes). This avoids persistent IAM role assignments or tenant account provisioning. Key Advantages Context-Aware Security: Mitigates credential theft risks by enforcing perimeter boundaries regardless of user IAM permissions. No Account Overhead: External entities do not need corporate directory accounts or Google Workspace identities. Granular Least Privilege: Signed URLs restrict access specifically to target URI paths and single objects rather than exposing entire buckets. Built-in Expiration: Access automatically expires after the cryptographic token timeout without manual revocation. Why This Is Optimal This architecture pairs foundational perimeter defense against data exfiltration with temporary, zero-footprint delegation of access to external partners.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Vpc Service Controls Signed Urls Storage Security

Section: Security and access management

An enterprise stores proprietary financial analytics data inside private Cloud Storage buckets located in a dedicated project. The organization has two key security requirements:

Prevent data exfiltration risks, such as unauthorized users or compromised credentials attempting to copy sensitive data to external Cloud Storage buckets outside organizational boundaries.
Provide external auditing firms with temporary, time-limited access to specific financial datasets without creating dedicated Google Workspace or Cloud Identity accounts for external users.

Which architectural strategy should you implement to satisfy both requirements?

Enclose the Cloud Storage project within a VPC Service Controls service perimeter, and generate Signed URLs with short expiration times for external auditors to access specific objects.

Configure uniform bucket-level access on the Cloud Storage buckets, and apply Cloud Armor security policies directly to the bucket storage endpoints.

Deploy Private Service Connect endpoints in a Shared VPC host project, and assign the roles/storage.objectViewer IAM role to a public Google Group containing the external auditors.

Enable Data Security Posture Management (DSPM) in Security Command Center, and attach Object Lifecycle Management rules to auto-delete objects after 24 hours.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Vpc Service Controls Signed Urls Storage Security

Section: Security and access management

An enterprise stores proprietary financial analytics data inside private Cloud Storage buckets located in a dedicated project. The organization has two key security requirements:

Prevent data exfiltration risks, such as unauthorized users or compromised credentials attempting to copy sensitive data to external Cloud Storage buckets outside organizational boundaries.
Provide external auditing firms with temporary, time-limited access to specific financial datasets without creating dedicated Google Workspace or Cloud Identity accounts for external users.

Which architectural strategy should you implement to satisfy both requirements?

Enclose the Cloud Storage project within a VPC Service Controls service perimeter, and generate Signed URLs with short expiration times for external auditors to access specific objects.

Configure uniform bucket-level access on the Cloud Storage buckets, and apply Cloud Armor security policies directly to the bucket storage endpoints.

Deploy Private Service Connect endpoints in a Shared VPC host project, and assign the roles/storage.objectViewer IAM role to a public Google Group containing the external auditors.

Enable Data Security Posture Management (DSPM) in Security Command Center, and attach Object Lifecycle Management rules to auto-delete objects after 24 hours.

Explanations

What VPC Service Controls and Signed URLs Are

VPC Service Controls allows organizations to create secure network and service perimeters around sensitive Google Cloud resources, such as Cloud Storage, preventing multi-tenant service communication from crossing perimeter boundaries. Signed URLs provide time-limited, cryptographically signed access to specific Cloud Storage objects without requiring the recipient to possess Google Cloud Identity credentials or direct Identity and Access Management (IAM) roles.

How It Meets the Requirements

Exfiltration Prevention: Placing the storage project within a VPC Service Controls perimeter guarantees that Cloud Storage APIs are shielded at the network layer. Even if an insider obtains valid credentials, VPC Service Controls blocks requests attempting to transfer or copy data to unmanaged storage buckets outside the designated perimeter.
Temporary External Access: Generating Signed URLs allows external auditors to perform HTTP GET requests against designated files for a predetermined lifespan (e.g., 60 minutes). This avoids persistent IAM role assignments or tenant account provisioning.

Key Advantages

Context-Aware Security: Mitigates credential theft risks by enforcing perimeter boundaries regardless of user IAM permissions.
No Account Overhead: External entities do not need corporate directory accounts or Google Workspace identities.
Granular Least Privilege: Signed URLs restrict access specifically to target URI paths and single objects rather than exposing entire buckets.
Built-in Expiration: Access automatically expires after the cryptographic token timeout without manual revocation.

Why This Is Optimal

This architecture pairs foundational perimeter defense against data exfiltration with temporary, zero-footprint delegation of access to external partners.

View source documentation

Professional Cloud Architect

Vpc Service Controls Signed Urls Storage Security

Professional Cloud Architect

Vpc Service Controls Signed Urls Storage Security

What VPC Service Controls and Signed URLs Are

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions