Google Professional Cloud Security Engineer Question 195
Select 2Google Cloud PlatformYour company hosts a web application on Google Cloud. The application is exposed to the internet through an external HTTPS load balancer. To ensure only specific users within your organization can access the web application, you need to configure network perimeter controls that enforce identity-aware access and secure communication. Which of the following steps should you take to achieve this?
- A
Enable Identity-Aware Proxy (IAP) on the HTTPS load balancer and configure access policies in IAM.
- B
Set up a Cloud Next Generation Firewall (Cloud NGFW) rule to allow incoming traffic only from your organization's IP range.
- C
Install SSL/TLS certificates on the application server to encrypt traffic.
- D
Use the Certificate Authority Service to issue and manage SSL/TLS certificates for the HTTPS load balancer.
- E
Configure a backend service on the HTTPS load balancer to only allow traffic from trusted zones.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure only specific users in your organization can access the application, you must implement Identity-Aware Proxy (IAP), which enforces access control based on user identity managed in IAM. Additionally, to secure communication, you should use the Certificate Authority Service to issue SSL/TLS certificates for the HTTPS load balancer. These steps address both identity-aware access and secure communication requirements.
- A. Correct.
Correct. Enabling Identity-Aware Proxy (IAP) on the HTTPS load balancer ensures that access to the application is restricted to authenticated users, based on IAM policies.
- B. Incorrect.
Incorrect. While restricting IP ranges can secure the application further, this step does not enforce identity-aware access, which is the requirement in this scenario.
- C. Incorrect.
Incorrect. Installing SSL/TLS certificates on the application server is unnecessary when using an HTTPS load balancer, as the load balancer manages encryption and decryption.
- D. Correct.
Correct. Using the Certificate Authority Service to issue and manage SSL/TLS certificates ensures secure communication between clients and the HTTPS load balancer.
- E. Incorrect.
Incorrect. Configuring a backend service to allow traffic from trusted zones does not address the need for identity-aware access control.