Google Professional Cloud Security Engineer Question 89
Single answerGoogle Cloud PlatformYour organization uses Google Cloud to host a critical web application. To enhance security, you are tasked with implementing an authentication mechanism that ensures users cannot access the application unless they are authenticated via a third-party Identity Provider (IdP). Additionally, this authentication mechanism must support multi-factor authentication (MFA). Which of the following is the most appropriate approach to meet these requirements?
- A
Configure Identity-Aware Proxy (IAP) with an external Identity Provider (IdP) that supports MFA.
- B
Enable Cloud Identity and configure it to enforce password policies for all user accounts.
- C
Use Google Cloud IAM roles to enforce authentication requirements for the application.
- D
Set up a VPN to restrict access to the web application and require user authentication.
Show answer and explanation
Correct answer: A
Explanation
To ensure users authenticate via a third-party Identity Provider (IdP) with multi-factor authentication (MFA), Identity-Aware Proxy (IAP) is the appropriate tool. IAP enables secure access to applications hosted on Google Cloud by integrating with external IdPs that support advanced authentication mechanisms like MFA. This approach directly addresses the requirements outlined in the scenario, ensuring robust authentication and security for the web application.
- A. Correct.
This is the correct answer because Identity-Aware Proxy (IAP) provides an authentication layer for applications hosted on Google Cloud. By integrating IAP with a third-party Identity Provider (IdP) that supports MFA, you can enforce both authentication and MFA requirements.
- B. Incorrect.
This option is incorrect because enabling Cloud Identity and enforcing password policies does not directly integrate with an application or enforce third-party IdP authentication and MFA.
- C. Incorrect.
This option is incorrect because IAM roles are used for authorization, not authentication. IAM cannot directly enforce authentication via a third-party IdP or MFA.
- D. Incorrect.
This option is incorrect because setting up a VPN restricts network access but does not enforce authentication via a third-party IdP or MFA.