2.2 Configuring Boundary Segmentation PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–17

1. 16foundation · easy

   What is the first step in configuring VPC Service Controls?

   • ACreate a firewall rule to allow traffic to the services.
   • BCreate a service perimeter and add the projects and services you want to protect.
   • CCreate a VPN tunnel to connect your on-premises network.
   • DEnable the VPC Service Controls API for your project.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company stores sensitive customer data in BigQuery and Cloud Storage. They are concerned about an insider threat where an employee with access to a Compute Engine instance could copy data from these services to an external location. They want to prevent data exfiltration while still allowing the instance to query BigQuery for legitimate processing. What should they do?

   • AUse IAM conditions to restrict the instance's service account to only have read access to BigQuery and Cloud Storage.
   • BCreate a VPC Service Controls perimeter that includes the BigQuery and Cloud Storage APIs, and set the instance's service account as an allowed resource in the perimeter.
   • CCreate a firewall rule that blocks all outbound traffic from the instance except to the BigQuery and Cloud Storage APIs.
   • DPlace the instance in a separate VPC network with no route to the internet.
   Reveal Solution Discussion Select an answer first