Data in BigQuery must not be exfiltrated, even by a user with valid credentials. What do you add?
Why D is the answer
VPC Service Controls perimeter
Service perimeters limit data movement across a trust boundary, which covers the stolen credential case.
In detail
- A VPC Service Controls perimeter limits data movement, even with valid credentials.
- IAM alone would allow a valid user.
Use case
An illustrative scenario, not a real incident.
Stolen credentials still cannot copy BigQuery data outside the perimeter, because the perimeter blocks it.
See it in different ways
flowchart LR A["Inside the perimeter: BigQuery and Cloud Storage"] -->|"Blocked"| B["Outside projects"] C["Access from an allowed context"] --> A
mindmap
root((Security))
Identity
Workload Identity Federation
Impersonation
Separation of duties
Data
Customer-managed keys
VPC Service Controls
Policy
Organization level
AI
Model ArmorsequenceDiagram participant P0 as Stolen credentials participant P1 as Service perimeter participant P2 as BigQuery P0->>P1: Export data outside P1-->>P0: Blocked P1->>P2: No data leaves
Key point: Perimeters limit data movement.
Why the other options are wrong
- A. Customer-managed encryption keys
- Keys encrypt data, and do not stop a valid user copying it.
- B. Bucket versioning on exports
- Versioning keeps copies.
- C. A stricter IAM password policy
- A password policy does not stop a valid user.