Cloud Digital Leader Trust and security with Google Cloud Practice Question
A multinational corporation uses Cloud Identity-Aware Proxy (IAP) to secure access to applications. They notice that some users outside the corporate network can still reach the applications. What is the most likely misconfiguration?
⚠ Common exam trap
Google Cloud often tests the distinction between 'allUsers' (anyone, including unauthenticated users) and 'allAuthenticatedUsers' (any authenticated Google identity), which is a common source of confusion for candidates who assume IAP always requires authentication regardless of the IAM setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAP is set to 'allUsers' instead of 'allAuthenticatedUsers'.
Setting IAP to 'allUsers' allows unauthenticated access from any user on the internet, bypassing IAP's authentication and authorization checks. IAP should be configured with 'allAuthenticatedUsers' or a more specific set of principals to enforce identity verification before granting access to the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
IAP is set to 'allUsers' instead of 'allAuthenticatedUsers'.
Why this is correct
In Cloud IAP, the IAM policy on the protected resource determines who can pass through. Setting the member to 'allUsers' includes any unauthenticated individual, so IAP does not require a Google identity and effectively disables authentication. The correct configuration is 'allAuthenticatedUsers', which mandates a valid Google login and verifies the user's identity.
- ✗
The firewall rules allow ingress from 0.0.0.0/0.
Why it's wrong here
Firewall rules operate at the network layer and control which IP subnets can reach the load balancer or backend. A rule allowing 0.0.0.0/0 merely permits inbound connections from any source; it does not alter IAP's identity-based access decisions. Because IAP intercepts requests and validates credentials before forwarding to the backend, a permissive firewall does not by itself allow unauthenticated users into an IAP-protected application.
- ✗
IAP is not enabled on the backend service.
Why it's wrong here
If IAP were completely disabled on the backend service, the load balancer would forward traffic without any authentication or authorization checks, allowing everyone—not just a subset—to access the application. The reported issue is that only some external users can access, which indicates an IAM policy that includes unauthenticated users rather than a disabled IAP. This option does not match the symptom of partial unauthorized access.
- ✗
The OAuth 2.0 client ID is misconfigured.
Why it's wrong here
The OAuth 2.0 client ID is used by IAP to validate the ID tokens that users present after Google authentication. A misconfigured client ID typically causes authentication failures, such as 'invalid audience' errors, which block all access for legitimate and illegitimate users alike. It would not expand access to unauthenticated users because the client ID is not an authorization policy; it only identifies the IAP instance during token validation.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Proxy
A proxy is an intermediary server that sits between a client and a destination server, forwarding requests and responses while providing security, privacy, and control.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.