PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company wants to allow their employees to access an internal web application running on Compute Engine using Identity-Aware Proxy (IAP). They want to ensure that only users from their corporate domain (example.com) can access the app. What is the recommended approach?
⚠ Common exam trap
A common misconception is that IP-based firewall rules (Option D) are sufficient for access control, but the trap here is that IAP is specifically designed to replace network-level controls with identity-based access, making IP filtering an outdated and insecure approach in this context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Cloud Identity group containing all corporate users, and grant the IAP-secured Web App User role to that group.
Identity-Aware Proxy (IAP) uses Cloud Identity groups to manage access at scale. By creating a group containing all corporate users (e.g., from example.com) and granting the IAP-secured Web App User role to that group, you enforce domain-level access without managing individual users. This approach leverages IAP's integration with Cloud Identity to verify the user's email domain against the group membership, ensuring only example.com users can reach the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the IAP-secured Web App User role to each individual user from the corporate domain.
Why it's wrong here
Works but not scalable; groups are preferred.
- ✓
Create a Cloud Identity group containing all corporate users, and grant the IAP-secured Web App User role to that group.
Why this is correct
Scalable and maintainable approach.
- ✗
Use a custom SAML attribute in the IdP to filter access.
Why it's wrong here
Using a custom SAML attribute is not the mechanism for IAP's primary domain restriction. IAP itself is configured to restrict access to users whose Google identity belongs to the specified corporate domain. However, custom SAML attributes are valuable for conveying additional user details from an external Identity Provider, such as Microsoft Entra ID, to IAP. This information can then be utilised to implement more granular Context-Aware Access policies for authorisation, allowing specific groups or roles within the permitted domain.
- ✗
Configure a firewall rule that allows traffic only from the corporate IP range.
Why it's wrong here
IAP works over the internet; firewall rules are not suitable for user-level access.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.