PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer needs to ensure that a specific Compute Engine instance can only be accessed via HTTPS from users authenticated through Cloud Identity. The instance is behind an HTTP(S) load balancer. What should the engineer configure on the load balancer to enforce this access control?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure IAP on the backend service of the load balancer
Identity-Aware Proxy (IAP) provides zero-trust access control for web applications and can be enabled on a load balancer backend service. It verifies user identity and context before allowing access. Configuring IAP on the backend service of the load balancer restricts access to authenticated users only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set firewall rules to allow only HTTPS traffic from the load balancer's IP ranges
Why it's wrong here
Firewall rules control network traffic but do not enforce user authentication; they allow any HTTPS traffic from those IPs.
- ✗
Enable HTTPS only on the load balancer and use client certificates for authentication
Why it's wrong here
Client certificates are for mTLS, which is not typically used for user authentication in web applications; IAP is the standard solution.
- ✗
Configure Cloud Armor with a security policy to require valid JWT tokens
Why it's wrong here
Cloud Armor provides WAF and DDoS protection, not user authentication; it can inspect tokens but is not designed for identity-based access control.
- ✓
Configure IAP on the backend service of the load balancer
Why this is correct
IAP can be enabled on the backend service of an HTTPS load balancer to enforce authentication and authorization for all requests.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.