Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An organization hosts a data-processing workload on Compute Engine instances that have only internal RFC 1918 IP addresses and no access to the public internet. The application running on these instances needs to interact programmatically with BigQuery and Cloud Storage APIs to analyze and store sensitive corporate data.
Security requirements dictate that:
Which combination of architectural controls should you implement to satisfy these requirements?
Configure VPC Network Peering directly to the Google APIs VPC network, and enforce the Domain Restricted Sharing organization policy constraint on the organization.
Assign external IP addresses to all instances, enforce strict egress VPC firewall rules blocking non-Google IP ranges, and implement Customer-Managed Encryption Keys (CMEK).
Deploy Cloud NAT on the VPC network to provide outbound internet access for the instances, and configure Identity-Aware Proxy (IAP) on BigQuery and Cloud Storage.
Enable Private Google Access on the subnet hosting the Compute Engine instances, and create a VPC Service Controls service perimeter enclosing the project and its BigQuery and Cloud Storage resources.
Configure VPC Network Peering directly to the Google APIs VPC network, and enforce the Domain Restricted Sharing organization policy constraint on the organization.
Assign external IP addresses to all instances, enforce strict egress VPC firewall rules blocking non-Google IP ranges, and implement Customer-Managed Encryption Keys (CMEK).
Deploy Cloud NAT on the VPC network to provide outbound internet access for the instances, and configure Identity-Aware Proxy (IAP) on BigQuery and Cloud Storage.
Enable Private Google Access on the subnet hosting the Compute Engine instances, and create a VPC Service Controls service perimeter enclosing the project and its BigQuery and Cloud Storage resources.
Private Google Access allows virtual machine (VM) instances that have only internal (private) IP addresses to privately connect to the public IP addresses and endpoints of Google APIs and services without requiring external IPv4 addresses. VPC Service Controls allows security architects to define fine-grained security perimeters around Google Cloud resources (such as Cloud Storage and BigQuery) to isolate sensitive services and prevent unauthorized data egress across organizational boundaries.
StudyCerts
StudyCertsbigquery.googleapis.com and storage.googleapis.com within protected projects.This approach directly addresses both network egress constraints and perimeter data exfiltration risks. IAM permissions govern identity-based authorization, while Private Google Access and VPC Service Controls provide the required network isolation and perimeter boundaries to stop data movement to untrusted external projects.