Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud VPN

  Why it's wrong here

  Cloud VPN establishes an encrypted IPsec tunnel between your on-premises or remote network and your VPC, authenticating at the network gateway level rather than per user. Once inside the tunnel, any client that has access to the VPN endpoint is implicitly trusted with broad network visibility and access. In a zero-trust model, every access attempt must be authorized individually based on user identity and context, which Cloud VPN is fundamentally incapable of providing—making it an inadequate replacement for IAP.

• ✓

  Identity-Aware Proxy (IAP)

  Why this is correct

  Identity-Aware Proxy (IAP) is a Google Cloud service that sits in front of your applications and proxies every request, enforcing access control based on the requester's identity, group membership, and contextual attributes such as IP address, device security status, and geolocation. Because it operates at the application layer (HTTP/S or TCP) rather than the network layer, it can grant or deny access to individual resources without changing your network topology or requiring a VPN. IAP is the core enforcement point for a BeyondCorp-style zero-trust architecture, enabling context-aware, least-privilege access to both web applications and SSH/RDP services.

• ✗

  Cloud Armor

  Why it's wrong here

  Cloud Armor provides network-layer DDoS protection and WAF rules at the Google Cloud edge, but it cannot evaluate user identity or device posture—the core requirements for context-aware access in a zero-trust model. It is tempting because its security policies can filter traffic by IP or geolocation, which might seem to address access control. Cloud Armor would be correct for defending a web application against volumetric attacks or OWASP Top 10 threats, not for enforcing identity- and device-based conditional access.

• ✗

  VPC Service Controls

  Why it's wrong here

  VPC Service Controls creates security perimeters around Google Cloud managed services like BigQuery, Cloud Storage, and Pub/Sub, primarily to reduce data exfiltration risks by restricting data movement to authorized projects and networks. However, these perimeters are defined at the service/API level and are not aware of individual user identities or device posture; they decide based on the originating network or project, not on who the user is or whether their device meets security policies. This makes VPC Service Controls a valuable defense-in-depth component, but it cannot enforce the identity- and context-based conditional access that zero-trust requires—IAP is the service designed for that purpose.

Go deeper

Related to this question