PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An organization wants to use Identity-Aware Proxy (IAP) to secure access to a web application running on Compute Engine. They need to ensure that only users with specific email domains can access the application, and also verify that requests are coming from IAP. Which two configurations are required? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a firewall rule that allows traffic only from IAP's IP ranges.
To secure access with IAP, you must allow IAP's IP ranges in the firewall (option B) and configure the backend to validate IAP-signed headers (option C). The IAP role is also needed but the question focuses on the two specific configurations for IP and header validation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Cloud Armor to block non-IAP traffic.
Why it's wrong here
Cloud Armor is not required; firewall rules suffice.
- ✓
Create a firewall rule that allows traffic only from IAP's IP ranges.
Why this is correct
IAP uses specific IP ranges that must be allowed in the firewall.
- ✓
Configure the backend application to validate IAP-signed headers (X-Goog-Authenticated-User-Email).
Why this is correct
The application should verify the signed header to ensure requests come from IAP.
- ✗
Assign the IAP-secured Web App User role to the users.
Why it's wrong here
The role is IAP-secured Web App User, but it's not required for header validation or firewall; it's for access control. Actually, it is needed to allow users, but the question asks for configurations for email domain restriction and request verification. The role can be assigned to groups with domain condition.
- ✗
Create an organization policy to enforce IAP usage.
Why it's wrong here
Not a required configuration for this specific setup.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.