A healthcare organization stores Protected Health Information (PHI) in Cloud SQL. They have implemented encryption at rest using CMEK and enforce TLS for all connections. To meet HIPAA compliance, they need to ensure that PHI cannot be exfiltrated from the Cloud SQL instance even if an application is compromised. The Cloud SQL instance is accessed by Compute Engine instances in the same VPC using private IPs. The security team wants to add an additional layer of defense against data exfiltration. What should they do?
VPC SC restricts data access to authorized networks and prevents exfiltration via internet.
Why this answer
VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect prevents data exfiltration by creating a security boundary around the Cloud SQL instance. Even if an application is compromised, the service perimeter blocks unauthorized copying or movement of PHI outside the perimeter, and Private Service Connect ensures traffic stays within Google's network without traversing the public internet. This directly addresses the requirement for an additional layer of defense against exfiltration beyond encryption and TLS.
Exam trap
In Google PCA exams, the trap is that candidates confuse encryption (CMEK) or secure connectivity (Auth proxy) with exfiltration prevention, not realizing that VPC Service Controls is the only option that creates a data boundary to block unauthorized data movement even from compromised applications.
How to eliminate wrong answers
Option A is wrong because Cloud Armor is a web application firewall (WAF) that protects HTTP(S) load-balanced traffic, but Cloud SQL uses private IPs within a VPC and does not have a public HTTP endpoint, so Cloud Armor cannot inspect or block traffic to the Cloud SQL instance directly. Option B is wrong because the Cloud SQL Auth proxy enforces IAM-based authentication and encrypts connections, but it does not prevent data exfiltration; if an application is compromised, the proxy still allows the attacker to query and extract PHI using valid credentials. Option D is wrong because CMEK is already implemented for encryption at rest, and encryption alone does not prevent data exfiltration—it only protects data if the storage media is stolen, not if an application is compromised and actively queries the database.