Google PCA Identity-Aware Proxy (IAP) Practice Question
A security engineer wants to configure Identity-Aware Proxy (IAP) for an HTTPS load-balanced application to enforce zero-trust access. Users will authenticate with their Google accounts. What is the minimum set of IAM roles needed for a user to access the application behind IAP?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/iap.httpsResourceAccessor
To access an application protected by IAP over HTTPS, a user must have the IAP-secured Web App User role (roles/iap.httpsResourceAccessor) on the resource. This role grants permission to access the resource through IAP. The other roles are not sufficient: roles/iam.serviceAccountUser is for managing service accounts, roles/iap.tunnelResourceAccessor is for TCP forwarding, and roles/compute.viewer only allows viewing Compute Engine resources, not accessing the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/iam.serviceAccountUser
Why it's wrong here
roles/iam.serviceAccountUser allows management of service accounts, not access to IAP-protected resources.
- ✗
roles/iap.tunnelResourceAccessor
Why it's wrong here
roles/iap.tunnelResourceAccessor grants access to IAP TCP forwarding, not HTTPS resources.
- ✓
roles/iap.httpsResourceAccessor
Why this is correct
roles/iap.httpsResourceAccessor (IAP-secured Web App User) is the correct role for accessing HTTPS applications behind IAP.
- ✗
roles/compute.viewer
Why it's wrong here
roles/compute.viewer allows read-only access to Compute Engine resources but does not grant access through IAP.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
About these practice questions
This PCA question is part of Courseiva's 955-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.