Question

A financial services company stores sensitive customer records in BigQuery and Cloud Storage across three projects. Security wants to guarantee that even if a valid service account credential is stolen, data cannot be queried or copied from outside the corporate environment. They also need engineers who work from the on-premises data center (accessing Google APIs through a Dedicated Interconnect) to continue analyzing the data without disruption. Which approach best establishes this data-exfiltration boundary?

Accepted Answer

Create a VPC Service Controls perimeter enclosing the three projects, protect the BigQuery and Cloud Storage APIs, and add an access level in Access Context Manager permitting the on-premises IP ranges reaching Google APIs via the Interconnect.

Answer

Apply an organization policy that restricts external IP addresses on all VMs and enable Private Google Access on every subnet in the three projects.

Answer

Configure firewall rules that deny all egress except to Google API ranges, and grant the analysts a custom IAM role limited to BigQuery read access.

Answer

Enable Cloud Armor security policies on the load balancers fronting the projects and require mutual TLS for all client connections to the data services.