A financial enterprise is designing a network architecture on Google Cloud to adhere to strict regulatory compliance standards for sensitive data workloads. The organization must meet the following security requirements: Prevent data exfiltration from Google-managed services (such as Cloud Storage and BigQuery) to unauthorized external storage resources or accounts. Ensure internal virtual machines (VMs) without external IP addresses access supported Google APIs exclusively over a private Google routing path. Restrict inbound HTTP(S) traffic to public-facing applications at the network edge based on source CIDR blocks and protect backends from direct internet exposure. Allow secure administrative SSH access to internal VMs without assigning public IP addresses or exposing port 22 directly to the public internet. Which combination of Google Cloud architectural controls should the enterprise implement?

Configure a VPC Service Controls perimeter enclosing the managed services and VPC networks, route Google API DNS queries to restricted.googleapis.com, attach Cloud Armor security policies to an external Application Load Balancer, and enable Identity-Aware Proxy (IAP) TCP forwarding for SSH access.: What the combined architecture is This architecture combines VPC Service Controls, Private Google Access via the restricted.googleapis.com virtual IP (VIP) address range, Google Cloud Armor edge security policies on an external Application Load Balancer, and Identity-Aware Proxy (IAP) TCP forwarding to form a layered defense-in-depth perimeter for regulatory compliance. How it meets all requirements Preventing data exfiltration: Enclosing projects, VPC networks, and managed storage services (Cloud Storage, BigQuery) within a VPC Service Controls service perimeter prevents data copying to external resources or access from unauthorized perimeters. Private Google API communication: Pointing the *.googleapis.com DNS zone to restricted.googleapis.com (which resolves to 199.36.153.4/30) ensures that internal VMs communicate with supported Google APIs across private routes and blocks access to unmanaged public services. Edge filtering and backend isolation: Attaching Cloud Armor security policies to the backend service of a global external Application Load Balancer enforces IP CIDR allowlists at Google Front Ends (GFEs) and pairs with VPC ingress firewall rules allowing only GFE IP ranges (35.191.0.0/16, 130.211.0.0/22). Secure internal SSH management: Using Identity-Aware Proxy (IAP) TCP forwarding allows administrators to establish encrypted SSH tunnels to internal RFC 1918 addresses over port 22 using Google-managed authentication without external IP addresses. Key advantages and capabilities Zero public IP footprint on backends: Eliminates internet attack surfaces on backend Compute Engine instances. Boundary data loss prevention: Enforces cryptographic and identity perimeter boundaries that IAM permissions alone cannot provide. Edge-level traffic inspection: Drops unauthorized public application requests at the Google edge before consuming VPC network bandwidth. Context-aware administration: Binds administrative SSH access to IAM identities and device context parameters. Why this is optimal This approach aligns with Google Cloud security best practices by implementing segmentation across all four critical planes: data API boundaries, private egress routing, public ingress edge inspection, and identity-aware management channels.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Design Network Segmentation Perimeter Controls Compliance

Section: Determining technical needs relative to compute, data, network, and storage.

A financial enterprise is designing a network architecture on Google Cloud to adhere to strict regulatory compliance standards for sensitive data workloads. The organization must meet the following security requirements:

Prevent data exfiltration from Google-managed services (such as Cloud Storage and BigQuery) to unauthorized external storage resources or accounts.
Ensure internal virtual machines (VMs) without external IP addresses access supported Google APIs exclusively over a private Google routing path.
Restrict inbound HTTP(S) traffic to public-facing applications at the network edge based on source CIDR blocks and protect backends from direct internet exposure.
Allow secure administrative SSH access to internal VMs without assigning public IP addresses or exposing port 22 directly to the public internet.

Which combination of Google Cloud architectural controls should the enterprise implement?

Configure a VPC Service Controls perimeter enclosing the managed services and VPC networks, route Google API DNS queries to restricted.googleapis.com, attach Cloud Armor security policies to an external Application Load Balancer, and enable Identity-Aware Proxy (IAP) TCP forwarding for SSH access.

Set up a dry-run VPC Service Controls perimeter, create Private Service Connect endpoints for third-party SaaS APIs, configure Cloud Armor network DDoS policies in preview mode, and disable serial console access across all VM instances.

Enforce the compute.skipDefaultNetworkCreation organization policy constraint, configure Cloud NAT for Google API egress, attach hierarchical firewall policies to allow 0.0.0.0/0 on port 22, and attach edge security policies to internal TCP/UDP load balancers.

Deploy a single-NIC Network Virtual Appliance (NVA) NAT proxy for all outbound traffic, configure DNS to resolve to private.googleapis.com, attach Cloud Armor policies directly to backend VMs, and configure a public bastion host VM for SSH hopping.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Design Network Segmentation Perimeter Controls Compliance

Section: Determining technical needs relative to compute, data, network, and storage.

Prevent data exfiltration from Google-managed services (such as Cloud Storage and BigQuery) to unauthorized external storage resources or accounts.
Ensure internal virtual machines (VMs) without external IP addresses access supported Google APIs exclusively over a private Google routing path.
Restrict inbound HTTP(S) traffic to public-facing applications at the network edge based on source CIDR blocks and protect backends from direct internet exposure.
Allow secure administrative SSH access to internal VMs without assigning public IP addresses or exposing port 22 directly to the public internet.

Which combination of Google Cloud architectural controls should the enterprise implement?

Explanations

What the combined architecture is

This architecture combines VPC Service Controls, Private Google Access via the restricted.googleapis.com virtual IP (VIP) address range, Google Cloud Armor edge security policies on an external Application Load Balancer, and Identity-Aware Proxy (IAP) TCP forwarding to form a layered defense-in-depth perimeter for regulatory compliance.

How it meets all requirements

Preventing data exfiltration: Enclosing projects, VPC networks, and managed storage services (Cloud Storage, BigQuery) within a VPC Service Controls service perimeter prevents data copying to external resources or access from unauthorized perimeters.
Private Google API communication: Pointing the *.googleapis.com DNS zone to restricted.googleapis.com (which resolves to 199.36.153.4/30) ensures that internal VMs communicate with supported Google APIs across private routes and blocks access to unmanaged public services.
Edge filtering and backend isolation: Attaching Cloud Armor security policies to the backend service of a global external Application Load Balancer enforces IP CIDR allowlists at Google Front Ends (GFEs) and pairs with VPC ingress firewall rules allowing only GFE IP ranges (35.191.0.0/16, 130.211.0.0/22).
Secure internal SSH management: Using Identity-Aware Proxy (IAP) TCP forwarding allows administrators to establish encrypted SSH tunnels to internal RFC 1918 addresses over port 22 using Google-managed authentication without external IP addresses.

Key advantages and capabilities

Zero public IP footprint on backends: Eliminates internet attack surfaces on backend Compute Engine instances.
Boundary data loss prevention: Enforces cryptographic and identity perimeter boundaries that IAM permissions alone cannot provide.
Edge-level traffic inspection: Drops unauthorized public application requests at the Google edge before consuming VPC network bandwidth.
Context-aware administration: Binds administrative SSH access to IAM identities and device context parameters.

Why this is optimal

This approach aligns with Google Cloud security best practices by implementing segmentation across all four critical planes: data API boundaries, private egress routing, public ingress edge inspection, and identity-aware management channels.

View source documentation

Professional Cloud Security Engineer

Design Network Segmentation Perimeter Controls Compliance

Professional Cloud Security Engineer

Design Network Segmentation Perimeter Controls Compliance

What the combined architecture is

How it meets all requirements

Key advantages and capabilities

Why this is optimal

Related questions