Professional Cloud Architect · Free Practice Question Medium
Question 1
For this question, refer to the Mountkirk Games case study. https://services.google.com/fh/files/blogs/master_case_study_mountkirk_games.pdf
Mountkirk Games is migrating several internal services to Google Cloud. Some services process sensitive telemetry data from gaming devices. These services must be protected using VPC Service Controls, but other services are public-facing APIs that should not be restricted. How should you design the service perimeter configuration?
-
A
Use a Shared VPC and apply VPC Service Controls at the host project level.
-
B
Place all services inside a single perimeter to simplify perimeter management.
-
C
Create separate service perimeters: one for sensitive services and another for public APIs.
-
D
Use organizational policy to prevent data exfiltration across all services.
Reveal correct answer
Correct answer: C
A.
VPC Service Controls are configured at the project level, not the Shared VPC host level. Also, this doesn’t address the requirement of separating sensitive and non-sensitive services.
B.
Placing all services into a single perimeter is overly restrictive. It would interfere with the functionality of public APIs, which need open access from the internet or third parties.
C.
Creating separate perimeters allows for fine-grained control. The sensitive telemetry data can be protected within a secure perimeter, while public APIs can remain unrestricted, meeting both business and security needs.
D.
Organizational policy constraints provide guardrails but are not sufficient for the level of protection VPC Service Controls provide, especially for preventing data exfiltration.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
