Question 917 of 961
IAP TCP Forwarding for SSH Access
A company uses Shared VPC with multiple service projects. The network admin wants to restrict access to certain Compute Engine instances so that only specific service accounts can SSH into them. What is the best practice to achieve this?
Quick Answer
The correct answer is to use Identity-Aware Proxy (IAP) TCP forwarding with IAM conditions. This is the best practice because IAP TCP forwarding enables SSH access to Compute Engine instances without exposing them to the public internet, while IAM conditions allow you to restrict which specific service accounts can invoke the IAP tunnel, giving you identity-based access control rather than relying on insecure source IP rules. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding of zero-trust networking in a Shared VPC environment, where the common trap is to suggest firewall rules or VPNs instead of leveraging IAP’s integration with IAM. Remember that IAP acts as a gatekeeper at the application layer, and the IAM condition is what locks that gate to only authorized service accounts. A useful memory tip: think of IAP as the “tunnel” and IAM conditions as the “key”—without the right key, no one gets through the tunnel.
⚠ Common exam trap
Watch out — candidates often confuse IAP with traditional firewall rules or VPC Service Controls, mistakenly thinking source IP filtering or perimeter-based controls can enforce identity-based access, whereas IAP is the only option that directly integrates service account identity with SSH access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Identity-Aware Proxy (IAP) TCP forwarding with IAM conditions restricting which service accounts can use IAP.
Identity-Aware Proxy (IAP) TCP forwarding allows SSH access to Compute Engine instances without exposing them to the public internet. By combining IAP with IAM conditions, the network admin can restrict which service accounts are permitted to use IAP, thereby controlling SSH access at the identity level rather than relying on source IP addresses. This approach aligns with Google Cloud's best practice for zero-trust network security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure firewall rules that allow SSH only from source IP ranges of the allowed service accounts.
Why it's wrong here
Firewall rules filter by IP, not service account.
- ✓
Use Identity-Aware Proxy (IAP) TCP forwarding with IAM conditions restricting which service accounts can use IAP.
Why this is correct
IAP provides secure access and IAM conditions allow granular control by service account.
- ✗
Use Organization Policies to restrict SSH access.
Why it's wrong here
Organization Policies are for broader constraints, not instance-level SSH control.
- ✗
Use VPC Service Controls with a service perimeter.
Why it's wrong here
VPC Service Controls protect data exfiltration, not SSH access.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer wants to SSH into a Compute Engine instance that has no public IP. Which service should they use?
easy- A.Direct Peering.
- B.Cloud NAT.
- ✓ C.Identity-Aware Proxy (IAP) TCP forwarding.
- D.Cloud VPN.
Why C: Identity-Aware Proxy (IAP) TCP forwarding allows secure, authenticated, and authorized SSH access to Compute Engine instances that have no public IP addresses. It works by establishing a tunnel through the IAP service, which proxies the SSH connection over HTTPS (port 443) to the instance's internal IP, eliminating the need for a public IP or bastion host.
Last reviewed: Jun 25, 2026
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.