Cloud Digital Leader Why Cloud Technology Can Transform Business Practice Question
A company wants to allow its employees to securely access internal applications without a traditional VPN. They want to use Google's zero-trust security model. Which Google Cloud product should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BeyondCorp Enterprise
BeyondCorp Enterprise is Google's zero-trust access solution that grants access based on user identity and context, not network location. Cloud VPN is traditional VPN. Cloud Armor is WAF. Identity-Aware Proxy (IAP) is part of BeyondCorp but the broader product is BeyondCorp Enterprise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud VPN
Why it's wrong here
Cloud VPN builds encrypted tunnels between networks, still requiring traditional network-level access rather than per-request identity verification. It is tempting as the established remote-access mechanism, but zero-trust access without a VPN is delivered by Identity-Aware Proxy.
- ✓
BeyondCorp Enterprise
Why this is correct
BeyondCorp Enterprise enforces identity- and context-aware access to internal apps directly over the internet, removing the VPN requirement the stem specifies. It applies Google's zero-trust model through per-request authorisation, device posture and continuous verification, satisfying the demand for secure access aligned to that model.
- ✗
Identity-Aware Proxy (IAP)
Why it's wrong here
Identity-Aware Proxy verifies user identity and context before granting access to internal apps, which is exactly Google's zero-trust model without a VPN. It is tempting because it also enforces access control, but it operates at the application layer rather than the network layer.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor filters HTTP traffic at the edge against DDoS and web attacks; it does not authenticate employee identities or broker access to internal applications. It is tempting because it enforces security policy at the perimeter, which suits protecting public-facing services, not zero-trust user access.
Go deeper
Related to this question
Learn chapter
LLM Concepts: Tokens, Context, Fine-Tuning
Key term
Model
In IT and AI, a model is a trained mathematical representation that learns patterns from data to make predictions or decisions.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
One of 848 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.