mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: An internal web application running on GKE must…
An internal web application running on GKE must be accessible only to employees who are authenticated with the company's Google Workspace account — without exposing it to the internet or using a VPN. Which GCP service provides identity-based access without a VPN?
⚠ Common exam trap
Candidates often confuse network-level controls (VPC Service Controls, Cloud Armor IP allowlists) with identity-based access, or they assume client-side authentication (Firebase) is sufficient for server-side access control, missing that IAP is the only service that combines identity verification with network edge enforcement without a VPN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Identity-Aware Proxy (IAP) configured on the load balancer in front of the GKE service
Cloud Identity-Aware Proxy (IAP) is the correct choice because it enforces identity-based access control at the application layer, verifying that users are authenticated via Google Workspace before allowing traffic to reach the GKE service through an HTTPS load balancer. This eliminates the need for a VPN or public internet exposure by leveraging Google's global infrastructure to authenticate and authorize each request based on the user's identity and context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Service Controls creating a perimeter around the GKE cluster
Why it's wrong here
VPC Service Controls is a security boundary that prevents data exfiltration by controlling access to Google Cloud APIs based on perimeter policies, but it does not authenticate users or handle browser-based identity verification. It can use identity-aware access levels only for API calls, not for enforcing employee Google account login before traffic hits a web application. Since the GKE service is a custom app, VPC SC perimeters alone cannot block unauthenticated HTTP requests.
- ✓
Cloud Identity-Aware Proxy (IAP) configured on the load balancer in front of the GKE service
Why this is correct
Cloud Identity-Aware Proxy (IAP) placed in front of the load balancer enforces zero-trust access by intercepting every request, forcing employees to authenticate with a Google account, and then checking their IAM roles or groups before authorizing forwarding to the GKE backend. This occurs entirely at the infrastructure layer, so unauthenticated and unauthorized requests are rejected before reaching the application, with no code changes required. IAP provides the exact browser-based identity authentication needed for this web app.
- ✗
Firebase Authentication SDK integrated into the web application frontend
Why it's wrong here
Firebase Authentication SDK is a client-side identity solution that requires embedding authentication logic into the web frontend code. While it can verify employee Google accounts, it only protects the user interface: an attacker can bypass the frontend and send requests directly to the backend service, because the load balancer and GKE service still accept unauthenticated traffic. IAP, in contrast, secures the entire endpoint at the infrastructure layer regardless of how the client is built.
- ✗
Cloud Armor with a Google Workspace IP allowlist
Why it's wrong here
Cloud Armor with a Google Workspace IP allowlist is fundamentally an IP-based access control mechanism, not an identity-based one. Employees often connect from dynamic IPs at home, mobile networks, or remote offices, making a static allowlist either too restrictive or prone to bypass by attackers spoofing allowed addresses. It also cannot verify that the person behind the IP is actually the authorized employee, whereas IAP ties each request to a verified Google identity.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
GKE
GKE is Google's managed Kubernetes service that automates deploying, scaling, and managing containerized applications in the cloud.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.