Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions
An enterprise wants employees to access internal web applications securely from any location (including remote work from home) without using a VPN. Employees should only access apps they're authorized for, based on their identity and device context. Which Google Cloud service enables this zero-trust access model?
⚠ Common exam trap
Candidates often confuse network-level security (like VPNs or IP allowlists) with identity-aware access control, assuming that any encrypted tunnel or IP restriction satisfies zero-trust requirements, but zero-trust fundamentally requires per-request identity and context verification, not just network perimeter controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Identity-Aware Proxy (IAP)
Cloud Identity-Aware Proxy (IAP) is the correct service because it enforces zero-trust access by verifying a user's identity and device context before granting access to internal web applications, without requiring a VPN. It uses Google's BeyondCorp model to authenticate and authorize each request based on identity and context, allowing secure access from any location.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud VPN with split tunneling for internal application access.
Why it's wrong here
Cloud VPN with split tunneling authenticates a device at the network layer and establishes an encrypted tunnel, but once connected, the user gains broad access to the internal network. Split tunneling only controls routing of traffic, not authorization to specific applications, and does not assess the user's identity or device posture for each request. It also requires managing client certificates and gateway infrastructure, which contradicts the zero-trust goal of identity-based, per-application access.
- ✓
Cloud Identity-Aware Proxy (IAP)
Why this is correct
Cloud Identity-Aware Proxy (IAP) is a zero-trust access layer that sits between users and applications, enforcing access policies based on the user's Google identity, OAuth2 scopes, and contextual attributes like device security status. When a request is made, IAP authenticates the principal, verifies the ID token, and checks against defined access-level conditions before proxying traffic to the backend. This eliminates the need for a VPN, as access decisions are made per request at the application layer, not based on network location.
- ✗
Cloud Armor IP allowlist to restrict access to corporate office IP ranges.
Why it's wrong here
Cloud Armor IP allowlists restrict traffic based on source IP address, which is a network-centric control and assumes offices have static, predictable IPs. Remote employees' home connections often have dynamic IPs, making allowlisting impractical, and any user reaching from a permitted IP is trusted without further authentication. This violates the principle of least privilege and zero trust, because access is granted on network location, not on verified identity and context, unlike IAP.
- ✗
Cloud Load Balancing with SSL termination.
Why it's wrong here
SSL termination at the Cloud Load Balancer decrypts incoming HTTPS traffic using a certificate, but this only provides transport-layer encryption. It does not authenticate individual users, enforce per-application authorization, or evaluate device context. Without integration with an identity provider or policy engine, it is merely network infrastructure, not an access control mechanism.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
BeyondCorp
BeyondCorp is a zero-trust security model developed by Google that shifts access control from the network perimeter to individual users and devices, enabling secure work from any location without a traditional VPN.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.