GCP Professional Cloud Security Engineer Practice Question

Your security team is adopting a zero-trust model for workloads on Google Cloud. They must:

Allow users to invoke Google Cloud APIs and use the Cloud Console only when requests come from company-managed devices located within the enterprise's public IP ranges.
Ensure that data in the payments project cannot be copied to resources in any other Google Cloud project or to external services, even by authorized users. Which approach leverages Access Context Manager to meet both requirements with minimal configuration overhead?

Implement VPC firewall rules to allow only corporate IPs and deploy a Cloud Armor security policy in front of BigQuery.
Create one access level that combines the device and IP conditions, and place the payments project inside a service perimeter.
Set an Organization Policy that blocks external data transfers and attach IAM conditions with IP constraints to every BigQuery dataset.
Create two separate access levels-one for device compliance and one for IP range-and assign them to the payments project.

Report Issue

Answer Description

Access Context Manager offers two complementary constructs:

Access levels attach attribute-based conditions such as IP subnets and device status to requests. A single composite access level that checks both "corporate-managed device" and "corporate IP range" satisfies the first requirement.
Service perimeters (implemented by VPC Service Controls) create a virtual boundary around one or more projects. Placing the payments project inside a perimeter prevents data exfiltration to resources outside the perimeter, meeting the second requirement. Other options are ineffective or incomplete: multiple access levels do not stop data exfiltration; VPC firewall rules and Cloud Armor do not control access to Google-managed services; Organization Policy and scattered IAM conditions do not enforce network-level egress restrictions inherent to service perimeters.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.