Google PCA Design for security and compliance Practice Question
A financial services company runs a PCI-DSS regulated workload on Compute Engine. Auditors require that all administrative access to the VMs is brokered through a single, auditable control plane with short-lived credentials, and that no external IP addresses are assigned to the VMs. Which Google Cloud feature should the architect implement to meet these requirements?
⚠ Common exam trap
The trap here is assuming that private network connectivity alone (VPN, Interconnect, or NAT) satisfies an auditing requirement for identity-brokered, short-lived administrative access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity-Aware Proxy (IAP) TCP forwarding with OS Login and IAM-based SSH access
Identity-Aware Proxy TCP forwarding tunnels SSH through Google's HTTPS edge after evaluating IAM policies, eliminating external IPs on the VMs. Paired with OS Login, it converts SSH access into IAM-governed, short-lived credentials and logs every session, giving auditors one brokered, centralized control plane with no public endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Interconnect with a dedicated VLAN attachment and firewall rules restricting SSH to the corporate CIDR
Why it's wrong here
Cloud Interconnect provides private connectivity but does not perform identity-aware authentication or credential issuance. SSH access would still rely on keys or passwords, sessions would not be centrally logged per identity, and the requirement for short-lived credentials brokered by a single control plane remains unmet.
- ✗
Cloud VPN with Cloud NAT configured for outbound-only access to the VMs
Why it's wrong here
Cloud VPN and Cloud NAT address network connectivity and outbound egress, not administrative authentication. They do not broker SSH through an identity-aware control plane, do not issue short-lived credentials, and do not produce per-user audit records for VM access, so the auditors' requirement for a single auditable access path would not be satisfied.
- ✓
Identity-Aware Proxy (IAP) TCP forwarding with OS Login and IAM-based SSH access
Why this is correct
IAP TCP forwarding tunnels SSH over HTTPS through Google's edge, so VMs need no external IP. Combined with OS Login, IAM policies control SSH access per user or group, credentials are ephemeral, and every session is logged to Cloud Audit Logs, satisfying the auditable single control plane requirement.
- ✗
Shielded VM with vTPM and UEFI Secure Boot enabled on all instances
Why it's wrong here
Shielded VM features protect boot integrity against rootkits and firmware tampering; they do not govern administrative access, issue credentials, or remove the need for external IPs. They are complementary hardening controls, not an access-brokering mechanism, so they cannot satisfy the auditable single control plane requirement.
Go deeper
Related to this question
Learn chapter
Virtual Machine Instances in Compute Engine
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
Key term
Proxy
A proxy is an intermediary server that sits between a client and a destination server, forwarding requests and responses while providing security, privacy, and control.
About these practice questions
This PCA question is part of Courseiva's 807-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.