PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An organization has set up IAP to protect a web application running on Compute Engine. The application needs to know the authenticated user's email address for logging. How can the application securely obtain this information?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Extract the email from the X-Goog-Authenticated-User-Email header after verifying the JWT signed by IAP.
IAP passes the authenticated user's identity to the backend application via signed HTTP headers (X-Goog-Authenticated-User-Email, X-Goog-Authenticated-User-Id). The application should verify the JWT signature of the IAP token (using Google's public keys) to trust these headers. The headers cannot be spoofed if the application verifies the JWT. Using Cloud Logging is not for real-time identity. The metadata server does not provide IAP user identity. The IAP API is for managing IAP configuration, not for retrieving user identity per request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Read the user's email from the instance's metadata server.
Why it's wrong here
The metadata server provides information about the instance and its service account, not about the IAP-authenticated user.
- ✓
Extract the email from the X-Goog-Authenticated-User-Email header after verifying the JWT signed by IAP.
Why this is correct
IAP sets signed headers with the user's identity; the application must verify the JWT to trust the header.
- ✗
Use the Cloud Logging API to query the most recent IAP access logs.
Why it's wrong here
Logging is asynchronous and not suitable for real-time identity extraction per request.
- ✗
Call the IAP API to retrieve the user identity.
Why it's wrong here
There is no IAP API to retrieve the current request's user identity; the identity is passed via headers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.