Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by kaia

Uniform bucket-level access allows you to manage permissions at the bucket level, rather than at the object level. This simplifies permission management and ensures that access to objects is controlled consistently via IAM roles, without allowing uploaders full control over the objects.

Steps:

Enable Uniform Bucket-Level Access: In the Google Cloud Console, enable uniform bucket-level access for the Cloud Storage bucket.

Configure IAM Policies: Assign appropriate IAM roles to users and groups to control access to the bucket.

Audit Logging: Enable Cloud Audit Logs to track access and modifications to the bucket.

The problem requires exposing a sensitive AI model endpoint internally (strictly isolated from the internet) to a defined list of projects within the organization.

Internal Exposure and Isolation: An "internal Application Load Balancer" is suitable for exposing services within your VPC network, ensuring they are not accessible from the internet.

Private Service Connect (PSC): This is the key technology for securely and privately exposing services from one VPC network (the service producer, where the model is) to other VPC networks (the service consumers, the defined list of projects) within the same or different organizations. PSC allows consumers to access services using internal IP addresses, with traffic remaining on Google's private network. You can configure a service attachment that points to the internal load balancer, and then permit specific consumer projects to connect to this service attachment.Extract Reference: "Private Service Connect is a capability of Google Cloud networking that allows consumers to access managed services privately from inside their VPC network. Similarly, it allows managed service producers to host these services in their own separate VPC networks and offer a private connection to their consumers." (Google Cloud Documentation: "Private Service Connect | VPC" - https://cloud.google.com/vpc/docs/private-service-connect)

Extract Reference: "Private Service Connect endpoints are internal IP addresses in a consumer VPC network that can be directly accessed by clients in that network. Endpoints are created by deploying a forwarding rule that references a service attachment or a bundle of Google APIs." (Google Cloud Documentation: "About Private Service Connect | VPC" - https://cloud.google.com/vpc/docs/private-service-connect)

Extract Reference: "Private Service Connect can be used to access managed services that are owned by Google, third-party software as a service (SaaS) companies, or other teams within the consumer's own company. Both published services and Google APIs can be targets of Private Service Connect." (Google Cloud Documentation: "About Private Service Connect | VPC" - https://cloud.google.com/vpc/docs/private-service-connect)

Let's evaluate the other options:

A. Shared VPC and central firewall rules: While Shared VPC centralizes network management, it does not provide a direct managed service exposure mechanism like PSC for a model endpoint to specific projects. It's more about sharing subnets and network resources. Administering all firewall rules centrally would also not meet the need for exposing only this specific model to a defined list of projects in a managed, private service pattern.

B. Activate Private Google Access (PGA): Private Google Access allows VMs without external IP addresses to access Google APIs and services (like Cloud Storage, BigQuery, etc.) privately from within their VPC network. It's for consuming Google services, not for exposing custom services hosted in a Google Cloud project to other projects.

D. External Application Load Balancer + Cloud Armor: An "external Application Load Balancer" exposes the service to the internet. While Cloud Armor can restrict access based on IP addresses, it still involves internet exposure, which contradicts the "strictly isolated from the internet" requirement. Restricting to "Google Cloud IP addresses" doesn't guarantee access only to a defined list of projects and still exposes the service externally.

Therefore, creating an internal Application Load Balancer and exposing it via Private Service Connect is the most suitable and secure solution for this scenario.

To delegate management of access control permissions to each business unit effectively, organizing projects into folders and assigning permissions to Google groups at the folder level allows for scalable and manageable access control. Using Google Cloud Directory Sync (GCDS) to synchronize users and groups from the on-premises directory service ensures that access controls are maintained and updated automatically as users change roles or leave the company.

Steps:

Organize Projects in Folders: Create a folder structure in the Google Cloud Resource Manager to organize projects by business unit.

Assign Permissions to Google Groups: Use IAM to assign necessary permissions to Google Groups at the folder level, ensuring each business unit can manage access controls for their own projects.

Synchronize Users and Groups: Use GCDS to sync users and group memberships from your on-premises directory service to Google Cloud Identity, ensuring that changes in the on-premises directory are reflected in Google Cloud.

Using Identity-Aware Proxy (IAP) for managing SSH access to private VMs ensures secure access control and avoids the need for public IPs. IAP allows you to enforce identity-based access control policies.

Enable IAP: Ensure that IAP is enabled for your project. This can be done via the Google Cloud Console under "Security" -> "Identity-Aware Proxy".

Set Up Firewall Rule: Create a firewall rule to allow SSH traffic from the IAP IP ranges.

Navigate to "VPC network" -> "Firewall".

Create a new rule allowing ingress traffic on port 22 (SSH) from the IAP IP ranges.

Assign IAP-Secured Tunnel User Role: Grant the roles/iap.tunnelResourceAccessor role to the administrators who need SSH access.

Go to "IAM & Admin" -> "IAM".

Assign the IAP-Secured Tunnel User role to the relevant users or groups.

SSH Using IAP: Administrators can now use IAP to SSH into the instances. This can be done using the gcloud command:

gcloud compute ssh [INSTANCE_NAME] --tunnel-through-iap