Exam Professional Cloud Security Engineer topic 1 question 168 discussion

Actual exam question from Google's Professional Cloud Security Engineer

Question #: 168
Topic #: 1

[All Professional Cloud Security Engineer Questions]

Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:
✑ The Cloud Storage bucket in Project A can only be readable from Project B.
✑ The Cloud Storage bucket in Project A cannot be accessed from outside the network.
✑ Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket.
What should the security team do?

A. Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.
B. Enable VPC Service Controls, create a perimeter around Projects A and B, and include the Cloud Storage API in the Service Perimeter configuration.
C. Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.
D. Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.

Show Suggested Answer

Suggested Answer: B 🗳️

by tangac at Sept. 3, 2022, 3:16 p.m.

Comments

Submit Cancel

Baburao

Highly Voted 1 year, 11 months ago

Should be B. VPC Peering is between organizations not between Projects in an organization. That is Shared VPC. In this case, both projects are in same organization so having VPC Service Controls around both projects with necessary rules should be fine.

upvoted 7 times

GHOST1985

1 year, 10 months ago

Answer is B, but you can ave vpc peering between two projects in the same organization, nothing prevents that if you have only two prjects to communicates vpc peering i better than shared vpc ;)

upvoted 2 times

...