mediumMultiple ChoiceObjective-mapped
PCSE Practice Question: Allow employees to access a web application…
A company wants to allow employees to access a web application running on Google Kubernetes Engine (GKE) using their corporate Active Directory credentials. The application is exposed via an HTTPS load balancer. The Security Engineer needs to integrate identity federation and ensure that only authenticated users can reach the application. Which combination of services should be used?
⚠ Common exam trap
Google Cloud often tests the misconception that IAP can directly use any identity provider (like raw Active Directory) without an OIDC/SAML federation bridge, leading candidates to pick option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.
It combines OIDC federation between Active Directory and Google Cloud with Identity-Aware Proxy (IAP) on the load balancer. IAP verifies user identity via OIDC tokens issued by the federated identity provider, ensuring only authenticated users can reach the application without exposing it to the public internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud Armor to allow only traffic from specific IP ranges and require client certificates.
Why it's wrong here
Cloud Armor does not handle user authentication.
- ✓
Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.
Why this is correct
IAP can authenticate users from an external OIDC provider.
- ✗
Enable IAP and configure it to use Active Directory as an identity provider.
Why it's wrong here
IAP does not directly support Active Directory; federation is needed.
- ✗
Configure Cloud Identity as the identity provider and use IAP.
Why it's wrong here
Cloud Identity does not integrate with Active Directory directly.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.