CV0-004 Security Practice Question
A cloud administrator is configuring a Linux virtual machine in Google Cloud. The security policy requires that all administrative access to the VM use short-lived SSH certificates issued by an internal certificate authority, rather than static SSH keys. Which GCP feature should be used to meet this requirement?
⚠ Common exam trap
The trap here is assuming that OS Login or IAP alone provides certificate-based authentication, when only the SSH certificate authority integration issues short-lived certificates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OS Login with SSH certificate authority
OS Login with an SSH certificate authority allows the organization to issue short-lived SSH certificates from an internal CA. Users authenticate with these certificates, and OS Login validates them, removing the need for static SSH keys. This directly fulfills the security policy requiring short-lived certificate-based administrative access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
OS Login with SSH certificate authority
Why this is correct
OS Login can be configured to use an SSH certificate authority. When enabled, the organization's CA issues short-lived SSH certificates to users, and OS Login validates them against the CA's public key. This eliminates static SSH keys and meets the requirement for short-lived, certificate-based administrative access to the Linux VM in Google Cloud.
- ✗
OS Login with two-factor authentication
Why it's wrong here
OS Login integrates SSH access with IAM and can enforce two-factor authentication, but it still relies on SSH keys managed by Google. It does not issue short-lived SSH certificates from an internal certificate authority. While it improves access management, it does not satisfy the specific requirement for certificate-based, short-lived SSH access from a custom CA.
- ✗
Google Cloud IAP TCP forwarding with SSH
Why it's wrong here
Identity-Aware Proxy (IAP) TCP forwarding secures SSH access by routing traffic through Google's infrastructure and enforcing IAM policies. However, it still uses SSH keys for authentication and does not issue short-lived certificates from an internal CA. It addresses network-level access control, not the certificate-based authentication requirement in this scenario.
- ✗
IAM roles with SSH key metadata
Why it's wrong here
IAM roles control permissions but do not directly manage SSH access methods. Storing SSH keys in instance metadata is a static key approach and does not provide short-lived certificates. This option does not meet the requirement for certificate-based authentication from an internal CA, and it also introduces risks associated with long-lived keys in metadata.
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.