What's changed: Created Professional Cloud Security Engineer Chapter 2 (Domain 2 "Boundary protection": Cloud NGFW/L7 inspection, Identity-Aware Proxy, load balancers, Certificate Authority Service, Cloud Armor, Secure Web Proxy, Cloud DNS security (DNSSEC), API restriction; VPC/peering/Shared VPC/firewall security, N-tier isolation, VPC Service Controls; private connectivity = HA VPN/Cloud Interconnect/Private Google Access (incl. on-prem)/restricted Google access/Private Service Connect/Cloud NAT).
2.2Boundary segmentation and private connectivity
Understand security properties of VPC/VPC peering/Shared VPC/firewall, network isolation and data encapsulation for N-tier apps, VPC Service Controls use cases/config, private connectivity between VPCs/projects (Shared VPC, VPC peering, Private Google Access for on-prem), encrypted connectivity between data centers and VPC (HA VPN, Cloud Interconnect), private connectivity to Google APIs (Private Google Access, restricted Google access, Private Service Connect), and egress via Cloud NAT.
Protect communication via isolation and going private. Segment the network, stop data exfiltration at a perimeter, and reach Google APIs privately.
2.2.1Segmentation and VPC Service Controls
Segment the network with VPCs, subnets, and firewall rules, and apply network isolation and data encapsulation per tier for N-tier apps. Common networking across projects = Shared VPC; connecting separate VPCs = VPC peering (non-transitive). The key data defense is VPC Service Controls: it blocks data exfiltration to managed services (BigQuery/Cloud Storage, etc.) with a service perimeter (a layer separate from IAM). Its value is that even stolen credentials cannot move data outside the perimeter. Map "prevent managed-service data exfiltration = VPC Service Controls."
2.2.2Private connectivity and reaching Google APIs
Connect data centers to the VPC encrypted: simple HA VPN (encrypted tunnel, 99.99% SLA) or high-bandwidth Cloud Interconnect (add MACsec/HA VPN over Interconnect if encryption is required). Reach Google APIs without public paths: Private Google Access from no-external-IP VMs, Private Google Access for on-premises hosts, restricted Google access (restricted.googleapis.com) to limit to allowed services, and Private Service Connect (PSC) for specific services. For general egress without external IPs, use Cloud NAT. Map "private reach to Google APIs = Private Google Access/restricted access/PSC" and "egress without external IP = Cloud NAT."
Common: requirement → means. E.g., "stop data leaving the perimeter even with stolen creds" = VPC Service Controls; "Google APIs from no-external-IP VMs" = Private Google Access; "limit reach to only allowed Google services" = restricted Google access; "private link to a specific managed service" = Private Service Connect; "encrypted DC link (simple)" = HA VPN; "egress without external IPs" = Cloud NAT.
Watch the mix-ups: (1) VPC Service Controls (anti-exfiltration, service perimeter) vs IAM (grants) are different layers—use both. (2) Private Google Access (private to Google APIs) vs Cloud NAT (general internet egress) differ in purpose. (3) VPC peering is non-transitive—consider hub-and-spoke for multi-hop.
2.2.3Section summary
- Segment = VPC/subnets/firewall; prevent exfiltration = VPC Service Controls perimeter
- DC link = HA VPN/Cloud Interconnect; private to Google APIs = Private Google Access/restricted access/PSC
- Egress without external IP = Cloud NAT; Shared VPC for common networking; peering is non-transitive
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To ensure BigQuery/Cloud Storage data cannot leave a defined boundary even if credentials leak, which is best?
Q2. To let no-external-IP VMs reach Google APIs (e.g., Cloud Storage) privately, which is best?
Q3. To limit reachable Google APIs to only allowed services and block paths to others, which is best?
Q4. To connect a data center and VPC over a simple encrypted tunnel redundantly with a 99.99% SLA, which is best?
Q5. To let many no-external-IP VMs make outbound internet calls, which is best?