A frontend on Compute Engine accesses Cloud SQL and a Cloud Storage bucket containing PII. How do you secure the PII following Google best practices?

The correct answer leverages Google's recommended security best practices for sensitive data. Configuring Cloud SQL with a private IP ensures that the database is not exposed to the public internet, reducing the attack surface. VPC Service Controls create a security perimeter around your sensitive resources (Cloud SQL and Cloud Storage), preventing data exfiltration and unauthorized access from outside the perimeter. Placing both resources in the same perimeter ensures consistent security policies and prevents data movement between them from bypassing the controls. Incorrect options: Firewall rules alone are insufficient for comprehensive data protection, especially against exfiltration. IAM controls access but doesn't prevent exfiltration from an authorized but compromised service account. Enabling private access for Cloud Storage is good, but without VPC Service Controls, it doesn't provide the same level of data exfiltration protection. Using different perimeters for Cloud SQL and Cloud Storage would allow data to move between them without being subject to the same strict perimeter controls, weakening security.