Google Cloud Professional Cloud Security Engineer Practice Exam

Which service can ensure that data in Cloud Storage is only accessible within the defined projects?

1. VPC Service Controls

2. Cloud Firestore

3. Service Account Permissions

4. Identity-Aware Proxy

The correct answer is: VPC Service Controls

VPC Service Controls is designed to enhance the security posture of services like Google Cloud Storage by creating a security perimeter around your Google Cloud resources. By using VPC Service Controls, you can restrict access to data within specified projects, ensuring that sensitive information is only accessible to designated resources and users. This allows you to define boundaries that prevent data exfiltration risks and establish safe communication channels between services. In contrast, Cloud Firestore is a NoSQL database service and does not directly manage access to Cloud Storage files. Service Account Permissions manage access at the IAM level but do not provide the additional network-level security perimeter that VPC Service Controls offers. Identity-Aware Proxy is a service that helps secure applications by controlling access to them based on identity, but it does not specifically apply to the project-level data access control required in this scenario. The ability of VPC Service Controls to set up security perimeters makes it the appropriate choice for ensuring that Cloud Storage data remains secure and only accessible within defined projects.