PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
Your organization uses Cloud Identity with SAML 2.0 federation from an external identity provider (IdP). You need to ensure that only users from a specific group in the IdP can access a critical application behind an HTTPS load balancer. Which combination of steps is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable IAP on the load balancer and grant the roles/iap.httpsResourceAccessor role to the Google group representing the IdP group
To restrict access to a specific group, you must first configure IAP on the backend service, then create an IAP access policy (or IAM binding) that grants the roles/iap.httpsResourceAccessor role to the Google group that corresponds to the IdP group. The IdP group must be synced to Google Cloud via directory sync or SCIM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a firewall rule that allows traffic only from the IdP's SAML endpoint IP
Why it's wrong here
Firewall rules are network-level and cannot authenticate users or groups.
- ✗
Set up a VPN between the IdP and Google Cloud and restrict access to the load balancer via VPC firewall
Why it's wrong here
VPN does not provide user-level access control; it only secures network traffic.
- ✗
Configure Cloud Armor to allow traffic only from the IdP's IP range
Why it's wrong here
Cloud Armor uses IP-based rules, not user identity; it cannot restrict by group membership.
- ✓
Enable IAP on the load balancer and grant the roles/iap.httpsResourceAccessor role to the Google group representing the IdP group
Why this is correct
This is the correct approach: IAP enforces authentication, and the IAM role controls authorization based on group membership.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.