Google Professional Cloud Security Engineer Question 140
Single answerGoogle Cloud PlatformA company wants to restrict access to its internal Google Cloud web application so that only employees accessing it from the corporate office network or using company-managed devices can connect. Which configuration step in Access Context Manager is required to achieve this?
- A
Create an access level with conditions based on IP subnet and device attributes.
- B
Assign roles/owner IAM role to the users accessing the application.
- C
Enable VPC Service Controls for the application.
- D
Create a custom IAM role with permissions to enforce the required restrictions.
Show answer and explanation
Correct answer: A
Explanation
Access Context Manager allows you to define fine-grained access policies using access levels. By specifying conditions such as IP subnets (corporate office network) and device attributes (managed devices), you can ensure that only users meeting these criteria can access the web application. Other options like IAM roles or VPC Service Controls do not fulfill the scenario's requirement.
- A. Correct.
Correct: Access Context Manager allows you to define access levels with conditions such as IP subnets and device attributes. This is the exact requirement in the scenario.
- B. Incorrect.
Incorrect: Assigning roles like roles/owner is unrelated to configuring access restrictions based on IP or devices. IAM roles define permissions but do not control network or device-based access.
- C. Incorrect.
Incorrect: Enabling VPC Service Controls secures data within services but does not handle access restrictions based on user location or device. This is not sufficient for the given scenario.
- D. Incorrect.
Incorrect: While you can create custom IAM roles, these roles are used to grant granular permissions. They cannot enforce IP or device-based access restrictions.