Professional Cloud Architect · Free Practice Question Medium
Question 15
Refer to the Mountkirk Games case study for this question: https://services.google.com/fh/files/blogs/master_case_study_mountkirk_games.pdf
As a cloud architect, your task is to deploy Virtual Private Cloud (VPC) Service Controls for Mountkirk Games. The objective is to allow developers to utilize Cloud Shell while ensuring they do not have unrestricted access to managed services. It is crucial to find a balance between these conflicting goals while considering the business requirements of Mountkirk Games. What steps should you take in this scenario?
-
A
You should use VPC Service Controls for the entire platform.
-
B
You should include all developers in an access level associated with the service perimeter, and allow them to use Cloud Shell.
-
C
You should create a service perimeter around only the projects that handle sensitive data, and do not grant your developers access to it.
-
D
You should prioritize VPC Service Controls implementation over Cloud Shell usage for the entire platform.
Reveal correct answer
Correct answer: C
A.
While secure, this option could negatively impact development efficiency and is not necessary if sensitive data is isolated appropriately. Using VPC Service Controls for the entire platform would provide a strong security posture, but it might be overly restrictive. Developers would likely face significant limitations in accessing necessary resources and services for their work, which could hinder productivity.
B.
This approach may compromise the security of sensitive data by allowing too much access. Including all developers in an access level associated with the service perimeter could allow developers to use Cloud Shell but may also inadvertently grant them access to sensitive resources, which contradicts the objective of restricting access to managed services.
C.
This approach strikes the right balance between security and usability, making it the most appropriate choice. Creating a service perimeter around only the projects that handle sensitive data allows you to restrict access to the most critical areas of your infrastructure while still giving developers the flexibility to use Cloud Shell for development purposes. This approach ensures that sensitive data is protected while balancing the need for developers to work efficiently. By not granting developers access to projects within the service perimeter, you ensure that they cannot inadvertently or maliciously access sensitive managed services, thereby reducing risk.
D.
Overly restrictive and does not offer a balanced approach, potentially hindering development work. Prioritizing VPC Service Controls implementation over Cloud Shell usage for the entire platform implies that security is given absolute precedence, potentially at the cost of usability. This could lead to developers being unable to effectively perform their duties, which may not align with the business requirements of Mountkirk Games.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
