A healthcare company stores patient records in BigQuery. Auditors worry that an insider with valid credentials could copy the data to a personal project outside the company. Which control creates a boundary that blocks such copies even when IAM permits access?
Show answer and explanation
Answer: B
VPC Service Controls define a service perimeter around Google Cloud projects and APIs such as BigQuery. Requests that would move data across the perimeter, for example to a project outside the company, are denied even when the caller holds valid IAM permissions. This addresses data exfiltration by authorized users or compromised credentials. Encryption keys protect stored data, policy tags govern column access within the perimeter, and budget alerts only report spending after the fact.
Why the other options are wrong
- A. Customer-managed keys control encryption of data at rest and can be rotated, but they do not stop authorized identities from reading data and copying it to outside projects.
- C. Policy tags restrict which users can see specific columns, which is useful for least privilege. They do not stop a permitted user from exporting readable data to an outside destination.
- D. Budget alerts notify owners when spending crosses thresholds. They do not prevent data movement and cannot stop a copy that has already happened.