GCP Professional Data Engineer Practice Question

A financial services company is building a batch Dataflow pipeline that reads encrypted files from a Cloud Storage bucket and writes the results to a BigQuery dataset in the same Google Cloud project. The security team has three mandatory controls: (1) all traffic must stay on Google's private backbone, (2) Dataflow workers must not have public IP addresses, and (3) any attempt to copy data to Google-managed services outside an approved boundary must be blocked automatically. Which architecture satisfies all requirements with the least operational overhead?

Use an organization policy to restrict external domains and rely on IAM conditions to block unauthorized copies, leaving the network configuration unchanged.
Create the Dataflow job in a subnet that has Private Google Access enabled and no public IP addresses, and place the project containing Dataflow, Cloud Storage, and BigQuery inside the same VPC Service Controls perimeter.
Apply an egress firewall rule that denies 0.0.0.0/0, keep public IP addresses on Dataflow workers, and use Cloud NAT so the workers can reach Cloud Storage and BigQuery over the internet.
Enable VPC Service Controls around Cloud Storage and BigQuery but allow Dataflow workers to keep their default public IP addresses to simplify networking.

Report Issue

Answer Description

Placing the project inside a VPC Service Controls perimeter stops Dataflow from writing to Google-managed services that are not included in the perimeter, preventing data exfiltration. Running the job in a subnet that has Private Google Access and creating the workers without public IP addresses keeps all traffic on Google's private network while still allowing the workers to call Cloud Storage and BigQuery APIs. No additional egress firewall rules or Cloud NAT gateway is required because the workers do not need outbound internet access once Private Google Access is enabled. The other options either leave public IP addresses enabled, rely only on firewall rules (which do not protect against calls to other Google services), or depend solely on organization policies and IAM, none of which alone prevent service-to-service exfiltration.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.