Your project is using Bigtable to store data that should not be accessed from the public internet under any circumstances, even if the requestor has a valid service account key. You need to secure…

Question

Options

• AUse Identity and Access Management (IAM) for Bigtable access control.
• BUse VPC Service Controls to create a trusted network for the Bigtable service.
• CUse customer-managed encryption keys (CMEK).
• DUse Google Cloud Armor to add IP addresses to an allowlist.

• A
  9% (2)
• B
  77% (17)
• C
  5% (1)
• D
  9% (2)

Explanation

VPC Service Controls creates a security perimeter around GCP services (including Bigtable). Even if an attacker obtains a valid service account key, requests originating from outside the defined trusted network perimeter will be denied. This is specifically designed to prevent data exfiltration and unauthorized access from the public internet regardless of credential validity. IAM (A) controls authorization based on identity/credentials, but a valid service account key would bypass it - IAM cannot block access based on network origin. CMEK (C) provides encryption key management but does not restrict network access at all. Cloud Armor (D) protects HTTP(S) Load Balancers and is not applicable to Bigtable's gRPC API.

No community discussion yet for this question.