Exam Professional Cloud Security Engineer topic 1 question 299 discussion

Answer is D, because that way you have complete isolation as required in the question. Explanation for C: C. Use VPC Service Controls (VPC-SC) is useful for protecting data from being exfiltrated, but it does not isolate an externally-facing app from internal systems. It is more suited for controlling access to sensitive APIs and services, not for network-level isolation.

You need stronger security and isolation for the externally-facing application and want to prevent unintended data access or leakage.

Agree with Pime13

Option C suggests creating a VPC Service Controls perimeter and placing the new application’s project within that perimeter. While VPC Service Controls can enhance security by defining a security perimeter around Google Cloud resources, it is primarily designed to protect data from being exfiltrated to unauthorized networks or users. It does not inherently provide the level of isolation needed for an externally-facing application. Creating a new project (Option D) ensures complete separation of resources, IAM policies, and network configurations, which is crucial for maintaining security isolation between internal and external applications. This approach minimizes the risk of accidental exposure of internal resources to the internet.

While VPC Service Controls offer strong isolation, they might be overkill for this scenario involving internal applications with moderate security needs.

It does not say anywhere that the external application should access internal resources. VPC peering would then be a massive security risk

It's D

D - Dedicated Project: Creating a new project for the externally-facing application provides a clear separation from internal systems, reducing the risk of unauthorized access or lateral movement. VPC Network Peering: Using VPC Network Peering allows the new project to access resources in the internal projects, while maintaining a controlled and secure boundary. This ensures that external traffic cannot directly access internal resources without going through the established peering connection. Improved Security: This approach offers enhanced security by minimizing the attack surface and limiting the potential impact of a breach.