Google Cloud Digital LeaderSecurity and operations with Google CloudHard
A government agency is deploying highly sensitive applications on Google Cloud. They require strict network perimeter control to prevent data exfiltration and ensure that sensitive data remains within a defined security boundary, even if misconfigurations or compromised credentials occur. Users should only be able to access these resources from trusted networks. Which Google Cloud service is specifically designed to create these secure perimeters?
- AVPC Service Controls
- BCloud Firewall
- CShared VPC
- DCloud VPN
Show answer & explanationAnswer & explanation
Correct answer: A. VPC Service Controls
VPC Service Controls creates secure perimeters around Google Cloud resources, restricting data movement and access to only authorized networks and identities, even in the event of misconfigurations or compromised credentials. This directly addresses the data exfiltration and trusted network access requirements.
Why the other options are wrong
- B. Cloud Firewall controls network traffic at a packet level within and between VPC networks, but doesn't prevent data exfiltration attempts by compromised identities or services outside the perimeter.
- C. Shared VPC allows multiple projects to use a common VPC network, which is a networking feature, not a data exfiltration prevention mechanism.
- D. Cloud VPN connects on-premises networks to Google Cloud, but doesn't create a data perimeter to prevent exfiltration between cloud services.
VPC Service Controls
VPC Service Controls helps mitigate the risk of data exfiltration from Google Cloud services by allowing you to define security perimeters around your sensitive resources.
- Creates security perimeters to isolate sensitive data and resources.
- Restricts operations to only authorized networks and identities.
- Prevents data exfiltration even if credentials are compromised.
- Protects against misconfigured IAM policies.
Memory trick: VPC Service Controls builds an unbreachable fence around your data.