Cloud Digital Leader Google Cloud Security Practice Question
A company wants to replace its VPN-based remote access with a solution that grants access to internal web applications based on user identity and device context, without requiring a VPN. Which Google Cloud service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity-Aware Proxy (IAP)
Identity-Aware Proxy (IAP) provides context-aware access to applications without a VPN, verifying user identity and device context. BeyondCorp Enterprise is a framework that includes IAP, but the question asks for the service that directly enforces access based on identity and context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access Transparency
Why it's wrong here
Access Transparency is a logging feature that provides an audit trail of actions taken by Google personnel on customer data, solely for compliance and security oversight. It records admin activity but does not evaluate the user trying to reach an application or enforce any authorization decision. Therefore, it cannot replace VPN-based remote access; it is a governance tool, not an access-control proxy.
- ✗
Cloud Identity
Why it's wrong here
Cloud Identity is an identity-as-a-service platform that centralizes user, group, and device lifecycle management, enabling SSO and MFA across SaaS and cloud apps. However, it simply authenticates who the user is and provides credentials; it does not mediate a specific HTTPS request to an application based on context such as IP or device security state. Thus, while it supports IAP, Cloud Identity alone cannot enforce context-aware application access the way a proxy does.
- ✓
Identity-Aware Proxy (IAP)
Why this is correct
Identity-Aware Proxy (IAP) sits in front of HTTPS applications and evaluates each connection using Google credentials and additional context like IP address, geolocation, and device security posture before granting access. It enforces fine-grained role-based policies per resource, eliminating the need for a full VPN for remote users. IAP also supports TCP forwarding for SSH/RDP, so it can directly replace VPN for administrative access to VMs.
- ✗
Cloud VPN
Why it's wrong here
Cloud VPN is a site-to-site IPSEC VPN service that securely connects your on-premises network to your VPC network via encrypted tunnels. It is designed for network-to-network connectivity, not for granting individual users federated access to specific applications from any device. Since it exposes an entire network rather than gating individual applications by identity, it does not solve the use case of replacing VPN-based remote access with a more granular solution.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.