CLOUD-SECURITY-ENGINEER practice question 17 of 35

You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that…

You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non- supported APIs. How should you configure the network?

Answer options

A: Enable Private Google Access on the regional subnets and global dynamic routing mode.

B: Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.

C: Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.

D: Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection. Correct answer

Correct Answer:

D. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.

Explanation

To access Google APIs from on-premises over a private connection while mitigating data exfiltration risks, restricted.googleapis.com is the correct choice. This special domain resolves to a VIP (Virtual IP) address range that only provides access to Google Cloud services and APIs that are supported by VPC Service Controls. By advertising the routes to this VIP range over the Cloud Interconnect, on-premises applications can connect privately. This configuration directly meets the requirements of preventing access over the public internet and limiting access to only VPC-SC supported APIs, thus strengthening the security posture against data exfiltration.

Why Incorrect

A. This enables private access for Google Cloud VMs, not on-premises hosts. It does not restrict API access to only those supported by VPC Service Controls.
B. Private Service Connect is used for privately consuming services hosted in another VPC, not for accessing Google APIs from on-premises in this manner.
C. private.googleapis.com provides access to a broader set of Google APIs and does not inherently restrict them to only those supported by VPC Service Controls, failing a key requirement.

References

1. Google Cloud Documentation, "Configuring Private Google Access for on-premises hosts". This document details the use of different domains for API access. (See section: "Domain and IP address options").

2. Google Cloud Documentation, "Private Google Access for on-premises hosts > Configuration overview". It states: "The VIP for restricted.googleapis.com... only allows access to Google APIs and services that are supported by VPC Service Controls." This directly supports the choice of D for mitigating exfiltration risk.

3. Google Cloud Documentation, "VPC Service Controls supported products". The use of restricted.googleapis.com is a key feature for enforcing VPC Service Controls, as it prevents access to services that are not integrated with the controls.

Keep practicing

Take the free CLOUD-SECURITY-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test