Google PCA Designing for Security and Compliance Practice Question
A company wants to implement a zero-trust access model for internal web applications running on Compute Engine. They need to authenticate users using corporate credentials and enforce context-aware access based on device posture and IP address. Which TWO services should they use?
⚠ Common exam trap
PCA often tests... the components of zero-trust architecture, and candidates might confuse IAP with Cloud Armor or VPC Service Controls, which serve different purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Identity
Cloud Identity (C) is correct because it provides the identity provider and user/group management that lets the company authenticate users with their corporate credentials, which is the foundation of a zero-trust identity model. Identity-Aware Proxy (IAP) (E) is correct because it enforces context-aware access to internal web applications on Compute Engine, evaluating user identity plus device posture and IP address before granting access, exactly matching the scenario's requirements. VPC Service Controls (A) is not correct here because it protects Google Cloud APIs and services at the perimeter level rather than authenticating users to internal web apps. Cloud VPN (B) only provides encrypted network connectivity and does not perform user authentication or context-aware access control. Cloud Armor (D) is a WAF/DDoS protection service that filters traffic at the edge but does not authenticate users or enforce device-posture-based access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Service Controls
Why it's wrong here
VPC Service Controls builds a service perimeter around Google Cloud APIs to block data exfiltration, but it neither authenticates users nor evaluates device posture or IP context. It is tempting because it underpins zero-trust data boundaries, and would be correct when the requirement is preventing data movement across project perimeters.
- ✗
Cloud VPN
Why it's wrong here
Cloud VPN provides an encrypted IPsec tunnel between on-premises networks and a VPC, so it cannot authenticate individual users against corporate credentials or assess device posture. It is tempting because it secures connectivity, and would be correct when the requirement is extending a private network to Google Cloud.
- ✓
Cloud Identity
Why this is correct
Cloud Identity provides the corporate credential directory and user authentication, which IAP then consumes to verify identity. It supplies the identity plane needed for zero-trust access to the Compute Engine applications, satisfying the corporate credentials requirement.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor provides edge security: WAF rules, DDoS protection and IP-based allow/deny policies. It does not authenticate users or evaluate device posture. Identity-Aware Proxy performs that context-aware authentication against corporate credentials. Cloud Armor is tempting for its IP filtering, but it operates at the network perimeter, not the identity layer.
- ✓
Identity-Aware Proxy (IAP)
Why this is correct
Identity-Aware Proxy enforces context-aware access to Compute Engine applications, evaluating device posture and IP address before granting access. It provides the zero-trust enforcement point that authenticates users via corporate credentials and applies the required contextual conditions.
Go deeper
Related to this question
Learn chapter
Billing, Budgets, and Cost Management
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
This PCA question is part of Courseiva's 807-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.