Google Cloud Professional Cloud Security Engineer PCSE — Topic 1 Question 168

Question

Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements: • The Cloud Storage bucket in Project A can only be readable from Project B. • The Cloud Storage bucket in Project A cannot be accessed from outside the network. • Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket. What should the security team do?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: Enable VPC Service Controls, create a perimeter around Projects A and B, and include the Cloud Storage API in the Service Perimeter configuration. Cloud Storage provides durable, scalable object storage that is fully managed. VPC Service Controls create a security perimeter around managed services to prevent data exfiltration. A VPC provides a global, software-defined private network for your Google Cloud resources.

Google Cloud Professional Cloud Security Engineer PCSE — Question 168