GCP Professional Cloud Security Engineer Practice Question

Your organization stores PII in BigQuery datasets in project "prod-data". Data analysts need to query these datasets from the BigQuery console only when they are on the corporate network 203.0.113.0/24. A Cloud Run service in a separate project "analytics" must read the datasets but must be blocked from writing the data to Cloud Storage or any other Google-managed service. With the smallest possible trust boundary, how should you configure VPC Service Controls to satisfy these requirements?

Enable Customer-Managed Encryption Keys (CMEK) on the BigQuery datasets and Cloud Run service, then rely on IAM permissions to restrict Cloud Storage writes from the service.
Place only "prod-data" in a service perimeter. Add an ingress rule that allows the Cloud Run service account from project "analytics" to call BigQuery, and leave egress rules open so the service can export results if needed.
Create a single service perimeter that includes both "prod-data" and "analytics". Within that perimeter add: (1) an egress rule that permits only the BigQuery API and denies all other Google APIs, and (2) an access level limited to the 203.0.113.0/24 corporate CIDR, then bind this access level to the perimeter.
Enable Private Google Access on the "prod-data" subnets and create VPC firewall rules that deny egress to the public IP ranges of Cloud Storage. Do not use VPC Service Controls to avoid added complexity.

Report Issue

Answer Description

Putting both projects in a single service perimeter prevents data exfiltration from the protected BigQuery service while still allowing the Cloud Run service to read the data, because calls that stay inside the perimeter are always permitted. An egress rule that limits access to only the BigQuery API ensures that services in the perimeter (including the Cloud Run service) cannot invoke Cloud Storage or any other Google-managed APIs. Creating an access level that lists the on-premises CIDR and attaching it to the perimeter lets analysts use the BigQuery UI only when they are on the corporate network. The other options fail to meet one or more requirements: keeping "analytics" outside the perimeter allows data to leave the boundary, merely enabling Private Google Access does not restrict Google API usage, and using CMEK does nothing to stop exfiltration.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.