Google Professional Cloud Developer Question 93
Single answerGoogle Cloud PlatformYou are developing a cloud-based application that serves sensitive data to authenticated users through a web interface. The application is hosted on Google Cloud and uses a backend service deployed in Cloud Run. To enhance the security of the application, you want to ensure that only authenticated users can access the backend service without requiring changes to the application code. Which security mechanism should you implement?
- A
Use Identity-Aware Proxy (IAP) to enforce authentication and authorization for access to the backend service.
- B
Enable Web Security Scanner to detect vulnerabilities in your application and protect the backend service.
- C
Use a public API key to restrict access to the backend service.
- D
Enable the default network firewall rules in Google Cloud to block unauthorized access.
Show answer and explanation
Correct answer: A
Explanation
Identity-Aware Proxy (IAP) is a Google Cloud security mechanism that allows developers to secure applications and resources by enforcing authentication and authorization at the application layer. This is particularly useful for protecting backend services like Cloud Run without requiring changes to the application code. Other options, such as Web Security Scanner or network firewall rules, do not provide the necessary application-layer access control required for this scenario.
- A. Correct.
Identity-Aware Proxy (IAP) is the correct choice because it provides a secure way to enforce authentication and authorization at the application layer without changes to the application code.
- B. Incorrect.
Web Security Scanner is used to identify vulnerabilities in web applications but does not enforce authentication or control access to the backend service.
- C. Incorrect.
Using a public API key is not a secure solution for protecting backend services, as keys can be easily exposed or misused.
- D. Incorrect.
Default network firewall rules in Google Cloud only provide basic network-level protection and do not enforce application-layer authentication or authorization.