An enterprise organization operates a hub-and-spoke topology across multiple Google Cloud projects. The hub project hosts private managed DNS zones for centralized internal microservices. The security team has defined the following requirements for all spoke VPC networks: Spoke VPCs must be able to query and resolve internal DNS records hosted in the hub project's private managed zones without replicating zone files across projects. The organization must mitigate data exfiltration and block malicious domains by overriding resolution for threat indicators to point to an internal sinkhole IP address, while allowing specific trusted subdomains to bypass these overrides. Service identities managing spoke infrastructure must follow the principle of least privilege, possessing only the permissions required to target the hub network for DNS resolution without administrative access to DNS records. Which combination of Cloud DNS security and architecture controls should the security engineer deploy?

Create Cloud DNS Peering Zones in the spoke VPC networks targeting the hub VPC network as the DNS producer network; configure Cloud DNS Response Policies associated with the spoke VPC networks that define local data sinkhole records and bypassResponsePolicy behavior rules; and grant the roles/dns.peer role to the spoke service identities on the hub project.: What Cloud DNS Peering, Response Policies, and DNS IAM roles are Cloud DNS Peering Zones, DNS Response Policies (RPZ), and the DNS Peer role (roles/dns.peer) provide a secure, scalable framework for centralized name resolution, granular traffic redirection, and least-privilege administrative access across multi-project Google Cloud environments. How it meets the cross-VPC resolution requirement A Cloud DNS peering zone is a private zone configured in a consumer network (the spoke VPC) that forwards DNS queries for a given namespace to a producer network (the hub VPC). This allows instances in spoke VPCs to query private records hosted centrally in the hub network without needing VPC network peering at the data plane or duplicating zone records across spoke projects. How it meets the security and exfiltration mitigation requirement Cloud DNS Response Policies act as a response policy zone (RPZ) mechanism applied directly to VPC networks. They evaluate DNS queries before standard resolution paths: Threat mitigation / Sinkholing: By adding response policy rules with localData, queries matching malicious or unauthorized domains are intercepted and resolved to an internal sinkhole IP address (or NXDOMAIN). Bypass exceptions: By configuring specific subdomain rules with the --behavior=bypassResponsePolicy attribute, trusted domain lookups bypass policy matching and resolve normally through authoritative zones or upstream resolvers. How it meets the least-privilege IAM requirement The predefined roles/dns.peer (DNS Peer) role allows an identity to establish a DNS peering link pointing to a VPC network in the target project without granting permissions to view, alter, or delete individual resource record sets or private managed zones in that target project. Key advantages and capabilities Centralized zone governance: Eliminates record synchronization drift across disparate VPC networks. Zero-trust DNS perimeter enforcement: Enforces response policy rules at the Google Cloud SDN resolver layer without requiring on-premises appliances or dedicated DNS forwarder VMs. Strict privilege separation: Keeps record creation (roles/dns.admin) segregated from network peering binding (roles/dns.peer).

Cloud Dns Peering Response Policies Sinkhole | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise hosts its primary domain in a Google Cloud DNS public managed zone. A security engineer must configure Domain Name System Security Extensions (DNSSEC) to protect client resolvers from DNS spoofing and cache poisoning attacks. The solution must establish a verified chain of trust with the third-party domain registrar and define a zero-downtime rotation procedure for the Key Signing Key (KSK). Which procedure should the security engineer implement?

Configuring Cloud DNS security settings.

AdvancedProfessional Cloud Security Engineer

An enterprise maintains a hybrid architecture connecting an on-premises data center to a Google Cloud Virtual Private Cloud (VPC) over Cloud Interconnect. The organization has established the following security and networking requirements for name resolution: On-premises clients must resolve internal Google Cloud private DNS zones and Private Service Connect endpoints. Google Cloud Compute Engine instances must resolve corporate domains hosted on on-premises domain controllers without manually modifying client resolver configurations. The security operations center (SOC) must monitor and audit all name resolution requests to detect domain generation algorithm (DGA) query patterns and potential DNS data exfiltration attempts. Which Cloud DNS design and policy configuration should the security engineer implement to satisfy these requirements?

Configuring Cloud DNS security settings.

AdvancedProfessional Cloud Security Engineer

A financial enterprise requires a secure, high-bandwidth connection between its on-premises data center and a Google Cloud VPC network. Compliance regulations mandate that all data in transit must be encrypted using IPsec tunnels, and the architecture must guarantee a 99.99% availability Service Level Agreement (SLA) with automated dynamic route propagation via BGP. Which configuration should the network security engineer implement to satisfy these requirements?

Designing and configuring private connectivity and encryption between data centers and VPC network (e.g., HA VPN, Cloud Interconnect).

AdvancedProfessional Cloud Security Engineer

An enterprise is securing its software supply chain across Google Kubernetes Engine (GKE) clusters and Cloud Run services using Binary Authorization. The security architecture requires: An attestor named prod-attestor that verifies cryptographic signatures generated by the CI/CD pipeline using a Cloud KMS asymmetric key pair. Storage and discovery of attestation occurrences via an Artifact Analysis note. Default policy enforcement requiring valid attestations from prod-attestor before container deployment across all production GKE clusters and Cloud Run services. A cluster-specific rule for a pre-production cluster (us-central1-a.staging-cluster) configured to log policy violations without blocking non-compliant container deployments. Which configuration should the security engineer implement to satisfy these requirements?

Configuring Binary Authorization to secure GKE clusters or Cloud Run.

AdvancedProfessional Cloud Security Engineer

An enterprise organization is structuring access for its engineering teams across distinct application environments organized into Development, Testing, and Production folders in Google Cloud. The organization has the following access and operational requirements: Multiple product squads (such as Squad Alpha and Squad Beta) require granular administrative permissions on their squad-specific resources within the Development folder. All developers across all squads must automatically inherit broad read-only and monitoring permissions across all non-production environment folders. Elevated write access to the Production folder must be restricted strictly to squad leads. User onboarding and offboarding must be managed with minimal administrative overhead, avoiding direct IAM policy updates on Google Cloud resource nodes while preserving clear audit trails. Which Cloud Identity group hierarchy and IAM binding design should the security engineer implement?

Managing permissions through groups.

FundamentalAssociate Data Practitioner

Transfer Appliance

Choose the appropriate data transfer tool (e.g., Storage Transfer Service, Transfer Appliance)

Professional Cloud Security Engineer

Cloud Dns Peering Response Policies Sinkhole

Related questions

Transfer Appliance

Professional Cloud Security Engineer

Cloud Dns Peering Response Policies Sinkhole

What Cloud DNS Peering, Response Policies, and DNS IAM roles are

How it meets the cross-VPC resolution requirement

How it meets the security and exfiltration mitigation requirement

How it meets the least-privilege IAM requirement

Key advantages and capabilities

Related questions

Transfer Appliance

What Cloud DNS Peering, Response Policies, and DNS IAM roles are

How it meets the cross-VPC resolution requirement

How it meets the security and exfiltration mitigation requirement

How it meets the least-privilege IAM requirement

Key advantages and capabilities