Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  VPN — employees connect to the corporate VPN which provides access to all apps.

  Why it's wrong here

  A VPN establishes an encrypted tunnel between an employee's device and the corporate network, authenticating the device or user to the network gateway. That network-level access does not propagate to individual applications; each app still needs to know who the user is, so the user must authenticate separately to every service unless an SSO layer is also present. VPNs solve transport and perimeter access, not identity federation, so they do not eliminate per-application password prompts or enable a single authentication event to cover all apps.

• ✓

  Single Sign-On (SSO) using SAML 2.0 or OIDC with Google Workspace as the Identity Provider.

  Why this is correct

  Google Workspace acts as the identity provider (IdP), authenticating the employee once and then passing a SAML 2.0 assertion or OIDC ID token to each SaaS application, which acts as a service provider. Because the assertion/token is cryptographically signed and trusted by the application, the user is granted access without needing to re-enter credentials or create a separate password. This is the correct approach because it decouples authentication from application access, enabling centralized lifecycle management and enforcing corporate MFA policies across all federated apps.

• ✗

  Cloud Armor — blocks unauthorized access attempts to applications.

  Why it's wrong here

  Cloud Armor is a distributed denial-of-service (DDoS) mitigation and web application firewall (WAF) service that protects applications at the edge by filtering traffic based on IP addresses, geographic regions, and configurable Layer 7 rules. It does not participate in authentication or identity federation; it cannot verify a user's identity or issue security assertions. While it can block a malicious request volume, it has no knowledge of a user's session or password, so it cannot provide single sign-on or remove the need for separate app credentials.

• ✗

  Shared service account — all employees use the same credential.

  Why it's wrong here

  A shared service account means all employees authenticate with the same credentials—a single username and password. This destroys any individual audit trail, as the actions of every user become indistinguishable, and violates the principle of least privilege because every user gets the same access rights. It also does not achieve SSO; rather, it replaces many unique passwords with one shared password, and if that credential leaks, the entire organization is compromised without any way to know who exposed it.

Go deeper

Related to this question