Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Security Command Center

  Why it's wrong here

  Security Command Center (SCC) is a security and risk management (SRM) platform that provides visibility into asset inventories, vulnerability findings, and threat detection across Google Cloud. It does not make or enforce per-user access decisions; rather, it continuously monitors configuration and activity for security posture. SCC can feed contextual signals (e.g., a vulnerable instance) into a zero-trust policy engine, but it is not an access-control layer in itself.

• ✗

  Cloud VPN

  Why it's wrong here

  Cloud VPN establishes an encrypted IPsec tunnel between on-premises networks and VPC networks, effectively extending a network perimeter into the cloud. Access is granted at the network layer based on source IP or network routing, so any user or device within the connected network can reach resources, regardless of identity, device health, or context. This reflects traditional perimeter-based trust, not the identity- and context-aware per-request decision model required by zero trust.

• ✗

  Identity-Aware Proxy (IAP)

  Why it's wrong here

  Identity-Aware Proxy (IAP) is an application-layer access control component that enforces policies based on user identity and OAuth scopes, but it relies solely on the signals available at the HTTP/HTTPS layer (such as user identity, login state, and resource path). IAP by itself does not perform continuous device posture checks, endpoint verification, or risk-based adaptive analysis; these are additional capabilities that BeyondCorp Enterprise adds through the Endpoint Verification agent and context-aware policies. Therefore, IAP is only one building block, not the complete zero-trust model.

• ✓

  BeyondCorp Enterprise

  Why this is correct

  BeyondCorp Enterprise is Google's fully integrated zero-trust solution that replaces the corporate VPN with identity- and context-aware access. It combines IAP with continuous device posture verification via Endpoint Verification, adaptive risk scoring, data loss prevention, and a centralized policy management console. BeyondCorp also offers a global 'kill switch' to instantly revoke access for any user or device, enabling security teams to enforce granular, zero-trust policies based on user identity, device state, and environmental context.

Go deeper

Related to this question