PCSE Identity-Aware Proxy (IAP) Practice Question
A security engineer needs to configure Identity-Aware Proxy (IAP) for a web application running on Compute Engine. The goal is to ensure that only authenticated users from the corporate domain can access the application. What is the first step in the configuration?
⚠ Common exam trap
A common mistake is to think enabling IAP on the backend service is the first step. However, the OAuth consent screen and credentials must be configured first as they are a prerequisite for IAP to function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure OAuth 2.0 consent screen and create credentials.
To configure Identity-Aware Proxy (IAP) for a web application on Compute Engine, the first step is to configure the OAuth 2.0 consent screen and create OAuth credentials. This establishes the authentication mechanism that IAP will use to verify user identity. After this, you can enable IAP on the backend service, create access policies, and assign roles. Attempting to enable IAP before setting up OAuth credentials will result in a configuration error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure OAuth 2.0 consent screen and create credentials.
Why this is correct
Correct. Configuring the OAuth consent screen and creating OAuth credentials is the prerequisite step. Without these, IAP cannot authenticate users.
- ✗
Enable IAP on the backend service of the load balancer.
Why it's wrong here
Incorrect. Enabling IAP on the backend service is a subsequent step. You must first configure OAuth consent and credentials, otherwise enabling IAP will fail.
- ✗
Create a firewall rule to allow traffic only from IAP IP ranges.
Why it's wrong here
Incorrect. Firewall rules for IAP IP ranges are used to restrict network access, but they are not the first step in configuring IAP itself. OAuth configuration comes first.
- ✗
Grant the IAP-secured Web App User role to the corporate domain users.
Why it's wrong here
Incorrect. Granting the IAP-secured Web App User role is done after IAP is enabled and an access policy is configured. It is not the first step.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.