Cloud Digital Leader Trust and security with Google Cloud Practice Question
Which TWO statements about Cloud Identity-Aware Proxy (IAP) are correct?
⚠ Common exam trap
Google Cloud often tests the misconception that IAP is limited to Google Cloud services or that it requires a third-party identity provider, when in fact IAP supports hybrid access and can use Google-managed identities without external IdPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAP can be used to protect access to Compute Engine VMs via SSH and RDP without a VPN
Cloud IAP enables identity-based access to Compute Engine instances via SSH and RDP without requiring a VPN or bastion host. IAP uses the user's identity and request context to create a secure tunnel, forwarding traffic to the instance over HTTPS and verifying the user's credentials before allowing the connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAP encrypts data at rest by default
Why it's wrong here
IAP is an access-control layer that authenticates and authorizes requests based on user identity and request context; it does not perform any data-at-rest encryption. Data-at-rest encryption is handled at the storage layer by Google Cloud's default server-side encryption or by customer-managed keys via Cloud KMS. Therefore, this statement incorrectly attributes a data-protection capability to IAP that it does not provide.
- ✓
IAP can be used to protect access to Compute Engine VMs via SSH and RDP without a VPN
Why this is correct
IAP enables secure SSH and RDP connections to Compute Engine VM instances through TCP tunneling over HTTPS, without requiring public IP addresses or a VPN. When a user initiates an SSH/RDP session, IAP validates their identity and authorizes access via IAM roles such as IAP-secured Tunnel User, then forwards the connection to the VM's internal IP. This eliminates the need for a bastion host and maintains a zero-trust posture.
- ✗
IAP only works with Google Cloud applications
Why it's wrong here
IAP is not limited to Google Cloud applications; it can also protect on-premises web applications through the IAP for on-premises connector, which establishes an outbound HTTPS connection from your data center to Google. Additionally, any HTTP(S) service running on Compute Engine, App Engine, or GKE can be fronted by IAP. This statement underestimates IAP's cross-environment reach.
- ✓
IAP uses the identity of the user and the context of the request to decide whether to allow access
Why this is correct
IAP makes access decisions by evaluating the authenticated user's identity together with contextual factors such as the source IP address, the device's security status, and the requested resource, against configured IAM or organization policies. It uses OAuth2/OIDC to obtain identity claims and then applies the policy before allowing the request. This context-aware authorization is the foundation of zero-trust security.
- ✗
IAP requires using a third-party identity provider
Why it's wrong here
IAP does not require a third-party identity provider; it natively works with Google Workspace or Cloud Identity as the identity source for authentication. While administrators can optionally federate an external identity provider such as Okta or Azure AD using SAML or OIDC, doing so is not a prerequisite for IAP to function. The statement incorrectly makes federation mandatory.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
Key term
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol Secure, or HTTPS, is the secure version of HTTP that encrypts data between a web browser and a website using SSL/TLS to protect sensitive information like passwords and credit card numbers.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.