Professional Cloud Security EngineerEnsuring complianceHard
A global banking institution is operating sensitive workloads on Google Cloud. They have a strict requirement to prevent data exfiltration and ensure that sensitive data remains within a defined security perimeter, even if an attacker compromises a service account or an application. They need to restrict network access between projects and services to only approved paths and prevent unauthorized movement of data to external networks or unapproved Google Cloud services. Which Google Cloud service is specifically designed to meet these stringent requirements?
- ACloud VPN
- BVPC Service Controls
- CShared VPC
- DPrivate Google Access
Show answer & explanationAnswer & explanation
Correct answer: B. VPC Service Controls
VPC Service Controls allows organizations to define security perimeters around their Google Cloud resources and services. This creates a data boundary that helps mitigate data exfiltration risks by preventing unauthorized access to data from outside the perimeter and restricting data movement to unapproved services, even in cases of compromised credentials.
Why the other options are wrong
- A. Cloud VPN creates a secure connection between on-premises networks and Google Cloud, but it doesn't enforce service perimeters or prevent data exfiltration within Google Cloud.
- C. Shared VPC allows multiple projects to use a common VPC network but does not prevent data exfiltration across services or to external networks.
- D. Private Google Access allows instances without external IP addresses to access Google APIs and services privately, but it does not create security perimeters or prevent data exfiltration from compromised resources.
VPC Service Controls
A Google Cloud service that allows organizations to create security perimeters around sensitive Google Cloud resources to mitigate data exfiltration risks and protect against unauthorized access.
- Creates data perimeters to isolate sensitive data.
- Restricts access to services from outside the perimeter.
- Prevents unauthorized data movement to external networks or unapproved services.
Memory trick: VPC Service Controls: Your Data's Walled Garden.