Cloud Digital Leader Why Cloud Technology Can Transform Business Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud VPN

  Why it's wrong here

  Cloud VPN establishes an IPsec tunnel between your VPC and an external network, encrypting traffic in transit but still granting access based on network location and pre-shared keys. It creates a trusted perimeter around the tunnel endpoint; once inside, users and devices are implicitly trusted without any per-request identity or device posture verification. This is the opposite of the zero-trust model, which continuously authenticates every user and device regardless of network path.

• ✓

  BeyondCorp Enterprise

  Why this is correct

  BeyondCorp Enterprise is Google's comprehensive zero-trust security solution. It shifts access decisions from the network perimeter to identity and context: each request is evaluated against the user's identity, device trust level, and contextual signals before granting access. By combining Identity-Aware Proxy, endpoint verification, threat/DPA protections, and security analytics, BeyondCorp Enterprise provides continuous, adaptive verification for both cloud and on-premises resources. This makes it the full framework rather than a single point solution.

• ✗

  Cloud Identity-Aware Proxy (IAP)

  Why it's wrong here

  Cloud Identity-Aware Proxy (IAP) is a key building block of zero trust, as it enforces access control based on Google identity and contextual attributes at the application layer. However, IAP alone is not a complete zero-trust solution—it lacks integrated endpoint verification, data loss prevention, session duration controls, and advanced threat detection that BeyondCorp Enterprise bundles together. Deploying only IAP leaves gaps in device posture assessment and continuous monitoring, so while it is a component, it is not the full framework the question asks about.

• ✗

  Firewall Rules

  Why it's wrong here

  Firewall rules are static, network-layer controls that filter traffic based on IP addresses, ports, and protocols. They cannot authenticate individual users, evaluate device health, or make per-request access decisions, and they implicitly trust any traffic that passes the rule. In a zero-trust model, network segmentation via firewalls is still useful as a defense-in-depth measure, but it is insufficient by itself because it relies on the outdated assumption that the internal network is safe. Zero trust requires identity- and context-aware enforcement, which firewall rules fundamentally lack.

Go deeper

Related to this question