Cloud Digital Leader Google Cloud Security Practice Question
A security team needs to implement a zero-trust architecture for a web application that is accessed by both internal employees and external partners. They require context-aware access that checks device posture and identity. Which THREE components should they use? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity-Aware Proxy (IAP)
BeyondCorp Enterprise provides the zero-trust framework, including device and identity verification. Identity-Aware Proxy (IAP) is a key component that enforces access based on context. Access levels in IAP define conditions (e.g., device posture, IP range) that must be met for access. Cloud Armor is for DDoS/WAF, not context-aware access. VPC firewall rules are network-level, not user-level. Chronicle is a SIEM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identity-Aware Proxy (IAP)
Why this is correct
Identity-Aware Proxy (IAP) enforces Zero Trust by brokering access to applications and resources based on the requester's identity and context, rather than their network location. It authenticates users via OAuth, checks IAM policies, and can be combined with context-aware conditions before proxying the connection. This ensures that even if a request originates from inside the VPC, it is only allowed if the user is verified and authorized, eliminating the need for a traditional VPN.
- ✗
VPC firewall rules
Why it's wrong here
VPC firewall rules are network-level controls that filter traffic based on IP addresses, ports, and protocols, typically at layers 3 and 4. They cannot verify who is sending or receiving the traffic, meaning they offer no identity- or context-aware enforcement. In a Zero Trust architecture, network location is not a sufficient trust anchor; because these rules treat all traffic from an allowed subnet as inherently trusted, they are fundamentally incompatible with the 'never trust, always verify' principle.
- ✓
Access levels (context-aware conditions)
Why this is correct
Access levels in Google Cloud's Identity and Access Management define context-aware conditions such as device posture, operating system, location, and time of day, which are evaluated alongside user identity to make dynamic authorization decisions. They enable granular, risk-based policies—for example, allowing access only to corporate-managed devices or restricting access to a specific geographic region. These conditions are integral to products like IAP and BeyondCorp Enterprise, and they implement the core Zero Trust idea that trust must be continuously re-evaluated based on real-time signals.
- ✓
BeyondCorp Enterprise
Why this is correct
BeyondCorp Enterprise is Google Cloud's commercial Zero Trust platform, built on the model that access to applications and data should be based on who a user is and the device they use, not the network they connect from. It combines IAP, context-aware access levels, threat and data protection, and client-side endpoint verification into a single solution. BeyondCorp Enterprise moves the access boundary from the network edge to each individual user and device, enabling seamless secure access from any location without the use of a traditional VPN.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor is a cloud-native network security service that provides DDoS mitigation and web application firewall capabilities, protecting apps from attacks like SQL injection and XSS. It filters traffic based on preset or custom rules, such as IP address reputation, geo-location, or OWASP Top 10 vulnerability signatures. However, it operates at the network/app layer and has no user identity awareness—it cannot authenticate individuals or enforce context-based access, so it is not a Zero Trust access-control mechanism.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
DDoS
A DDoS (Distributed Denial-of-Service) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple compromised systems.
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.