Exam Professional Cloud Security Engineer topic 1 question 256 discussion

"minimize exfiltration risk, only allow required connections, and follow the principle of least privilege" - C follow the principle of least privilege While a perimeter bridge allows communication between two service perimeters, it may grant broader access than necessary and does not adhere to the principle of least privilege, as it could expose resources to more connections than intended.

"minimize exfiltration risk, only allow required connections, and follow the principle of least privilege" - C follow the principle of least privilege

https://cloud.google.com/vpc-service-controls/docs/share-across-perimeters#example_of_perimeter_bridges

A perimeter bridge allows limited communication between resources in two service perimeters. By explicitly specifying the Cloud Storage buckets involved, you restrict the scope of the bridge to only the required resources. While egress and ingress rules control data flow, they are typically used for access to services outside the perimeters, not between two perimeters. Additionally, this approach lacks granularity and risks unintended exposure.

To enable data transfer between two VPC Service Controls service perimeters while minimizing exfiltration risk and adhering to the principle of least privilege, you need to use a perimeter bridge. This bridge allows controlled communication between the two perimeters but must be configured to include only the specific resources (in this case, the Cloud Storage buckets). Here's why the other options are less suitable: A perimeter bridge between projects is overly broad and does not align with the principle of least privilege. It would allow communication for all resources in the projects, increasing the risk of exfiltration. C. Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B. VPC Service Controls do not directly support simple egress/ingress rules between perimeters. Perimeter bridges are the designed mechanism for controlled inter-perimeter communication.

https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules

Looks like this chat has been infiltrated. Clearly the correct answer is A. this exact feature exists for this use case.

C: Data exchange between clients and resources separated by perimeters is secured by using ingress and egress rules. https://cloud.google.com/vpc-service-controls/docs/overview

C

I think B is too broad in scope.

It should be C, due to the offered granular control and principle of least priviledge

I think it's B.