You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B. You also want to ensure that data in the Cloud Storage bucket…

Question

Options

• AEnable VPC Service Controls, create a perimeter with Project A and B, and include Cloud
• BEnable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud
• CEnable Private Access in Project A and B networks with strict firewall rules to allow
• DEnable VPC Peering between Project A and B networks with strict firewall rules to allow

• A
  43% (24)
• B
  14% (8)
• C
  11% (6)
• D
  32% (18)

Explanation

VPC Service Controls creates a security perimeter around GCP resources (projects and services) that restricts access based on context - not just credentials. By creating a perimeter that includes both Project A and Project B and the Cloud Storage API, you ensure: (1) only requests originating from within the perimeter (Projects A and B) can read the bucket, and (2) data cannot be copied to Cloud Storage buckets outside the perimeter even by users with valid credentials - this is data exfiltration protection. Domain Restricted Sharing (B) controls who can be granted IAM roles but does not prevent data movement between buckets. Private Google Access (C) and VPC Peering (D) control network routing but do not enforce API-level data boundaries or prevent credentialed exfiltration.

No community discussion yet for this question.