Professional-Cloud-Security-Engineer Leak Questions

Comprehensive and Detailed Explanation From Exact Extract:

This question combines two powerful security features: VPC Service Controls (VPC SC) for data exfiltration prevention and Context-Aware Access (CAA) for fine-grained user access based on context.

Contextual Requirement: Requiring a "company-managed device," "specific location," etc., is the function of Context-Aware Access (CAA), implemented via an Access Level.

Combining VPC SC and CAA: CAA policies can be integrated with VPC SC perimeters to enforce the context for access into the perimeter.

Evaluating Impact: To evaluate changes without blocking access, the entire VPC SC perimeter (including the new CAA rule) should be configured in dry run mode.

Extracts:

"Context-Aware Access (CAA) allows you to define and enforce granular access to Google Cloud resources based on user attributes like device security status, IP address (location), and identity." (Source 3.1)

"When implementing a new security policy... it is best practice to initially configure the VPC Service Controls perimeter (including any associated Access Levels/Context-Aware Access) in dry run mode. Dry run mode allows you to test the perimeter's effect on services without blocking any access." (Source 3.2)

"You can use an Access Level (the core component of CAA) to define the conditions for accessing resources protected by a Service Perimeter." (Source 3.3)

Cloud Asset Inventory: Using Cloud Asset Inventory allows you to quickly identify all the external assets and resources in your Google Cloud environment. This includes information about your projects, instances, storage buckets, and more. This step is crucial for understanding the scope of your audit. Network Security Scanner: Once you have identified the external assets, you can run a network security scanner to assess the security of these assets. Network security scanners can help identify vulnerabilities and potential security risks quickly.

"In order to be able to keep using the existing identity management system, identities need to be synchronized between AD and GCP IAM. To do so google provides a tool called Cloud Directory Sync. This tool will read all identities in AD and replicate those within GCP. Once the identities have been replicated then it's possible to apply IAM permissions on the groups. After that you will configure SAML so google can act as a service provider and either you ADFS or other third party tools like Ping or Okta will act as the identity provider. This way you effectively delegate the authentication from Google to something that is under your control."

"Cloud Identity has a catalog of automated provisioning connectors, which act as a bridge between Cloud Identity and third-party cloud apps."