CV0-004 Operations and Support Practice Question
A cloud administrator manages a fleet of Linux virtual machines on Google Cloud. A compliance rule requires that an interactive SSH session to any of these instances be brokered through an identity-aware proxy so that sessions are authenticated and auditable, and that no external IP addresses be assigned to the instances. Which solution should the administrator implement?
⚠ Common exam trap
The trap here is treating a network-location control such as a VPN or firewall range as equivalent to identity-aware session brokering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Identity-Aware Proxy TCP forwarding to reach each instance over its internal IP, with firewall rules allowing the IAP range.
The rule has two parts: identity-aware brokering of interactive sessions and no external addresses on the instances. Identity-Aware Proxy TCP forwarding satisfies both because it authenticates the user's identity and IAM permissions before tunneling SSH over the internal address, and the firewall only needs to allow the IAP source range. External IPs, bastion hosts, and VPN-only access all authenticate network location rather than user identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Cloud VPN tunnel from the corporate network and allow SSH from the corporate address range only.
Why it's wrong here
A VPN authenticates the corporate network rather than an individual identity, so any device on that network could reach the instances. It also requires the instances to be reachable from the tunnel, and it does not provide per-session identity-aware auditing. The control is network-based, not identity-based, so it does not meet the stated compliance rule.
- ✗
Assign external IP addresses to each instance and restrict ingress to the administrator's source IP range with firewall rules.
Why it's wrong here
Assigning external IP addresses directly contradicts the requirement that instances have none, and a source-IP firewall rule authenticates a network location rather than a user identity. It also produces no per-session audit trail tied to an identity. This approach weakens the security posture while failing the identity-aware and no-external-IP constraints.
- ✗
Deploy a bastion host with an external IP and have administrators SSH to the bastion before connecting to each instance.
Why it's wrong here
A bastion host typically requires an external address of its own and shifts the identity check to a shared jump box, which is not identity-aware per user unless additional tooling is added. It also concentrates risk and does not by itself produce per-user session audit records. The no-external-IP requirement is difficult to satisfy with this pattern.
- ✓
Use Identity-Aware Proxy TCP forwarding to reach each instance over its internal IP, with firewall rules allowing the IAP range.
Why this is correct
IAP TCP forwarding tunnels SSH over the internal IP through Google's infrastructure, authenticating the user's identity and IAM role before the connection is allowed. Because the instance needs no external address and the firewall permits only the IAP source range, the compliance rule is satisfied. Access is also logged per session, giving the auditability the rule demands.
Go deeper
Related to this question
About these practice questions
One of 834 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.