Answer-first summary for fast verification
Answer: Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B.
The correct answer is C because it best aligns with the requirements to minimize exfiltration risk, allow only required connections, and follow the principle of least privilege. Ingress and egress rules provide granular control by allowing specific data flows between service perimeters for defined resources, services, and identities, reducing the risk of unintended exposure. This approach is supported by Google Cloud documentation stating that ingress and egress rules can replace perimeter bridges for simplified and secure data exchange. While option A (perimeter bridge) is a valid mechanism, it may grant broader access than necessary, as perimeter bridges allow communication between entire perimeters or specified resources, potentially increasing exfiltration risk. Option B is overly broad, as it bridges entire projects, violating least privilege. Option D's bidirectional rule is unnecessary and less secure, as the data flow is unidirectional (from Perimeter-A to Perimeter-B). The community discussion shows strong support for C, with high upvotes and references to official documentation emphasizing granular control.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter-B, in Google Cloud. You need to copy data from a Cloud Storage bucket inside Perimeter-A to another Cloud Storage bucket inside Perimeter-B. You must minimize exfiltration risk, only allow necessary connections, and adhere to the principle of least privilege. What should you do?
A
Configure a perimeter bridge between Perimeter-A and Perimeter-B, and specify the Cloud Storage buckets as the resources involved.
B
Configure a perimeter bridge between the projects hosting the Cloud Storage buckets in Perimeter-A and Perimeter-B.
C
Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B.
D
Configure a bidirectional egress/ingress rule for the Cloud Storage buckets in Perimeter-A and Perimeter-B.