Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A financial enterprise processes sensitive market data across Compute Engine instances, BigQuery datasets, and Cloud Storage buckets within Google Cloud. A security review identifies two primary data exfiltration threats:
Which perimeter security architecture should the cloud security engineer implement to mitigate both exfiltration vectors?
VPC Service Controls is a Google Cloud security capability that establishes context-based perimeter boundaries around Google-managed service resources and VPC networks. Rather than relying solely on identity authentication, it restricts API access and data movement strictly within defined service perimeters.
StudyCerts
StudyCertsbigquery.googleapis.com) and Cloud Storage (storage.googleapis.com) in the perimeter and utilizing the restricted VIP (restricted.googleapis.com), VPC Service Controls prevents commands (such as bq mk or gcloud storage cp) from moving or copying data from resources inside the perimeter to storage resources outside the perimeter, even when executed by authorized identities.allUsers or allAuthenticatedUsers), VPC Service Controls intercepts and denies incoming requests originating from unauthorized external networks or contexts.Identity-based controls (IAM) cannot prevent a compromised authorized user from reading corporate data and writing it to an unmanaged external resource. VPC Service Controls explicitly enforces egress boundaries on Google-managed APIs, making it the only native solution designed specifically to stop this exfiltration vector.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.