An enterprise is migrating sensitive internal web applications and Compute Engine instances to Google Cloud. The security team needs to implement a Zero Trust access architecture that meets the following criteria: Administrators and developers must access internal web applications and connect to Compute Engine instances via SSH without exposing workloads to public IP addresses. Access must be strictly conditioned on user identity and verified device posture telemetry (such as corporate-managed devices). All administrative actions, configuration changes, and individual connection attempts (both successful and failed) must be captured for regulatory compliance and security analysis. Which architecture should you implement to satisfy these requirements?

Configure Identity-Aware Proxy (IAP) for internal web apps and IAP TCP forwarding for SSH, enforce device posture using Access Context Manager access levels applied through IAM conditions, and enable Cloud Audit Logs Data Access logging.: ### What this solution is This architecture combines **Identity-Aware Proxy (IAP)**, **Access Context Manager (ACM)**, and **Cloud Audit Logs** to establish a comprehensive Zero Trust access model for Google Cloud resources. ### How it meets the requirements - **No public IP exposure**: IAP and **IAP TCP forwarding** act as secure cloud-native reverse proxies, allowing authenticated users to access internal web apps and establish SSH sessions to Compute Engine VMs without attaching external public IP addresses or managing public bastion hosts. - **Context-aware and device posture access**: **Access Context Manager** defines granular access levels based on device signals, client telemetry (managed status, OS versions), and user identity. These levels are enforced dynamically at the application and TCP level using **IAM conditions**. - **Comprehensive audit visibility**: By enabling **Data Access audit logs** alongside default **Admin Activity audit logs**, Google Cloud records all administrative operations, configuration changes, and every successful and failed user connection attempt through IAP. ### Key advantages and capabilities - Eliminates attack surface related to open inbound internet ports (like port 22 or 80/443). - Enforces dynamic, context-aware policy decisions on every request rather than relying purely on perimeter network location. - Provides end-to-end traceability of identities and endpoints within central audit sinks. ### Why this is optimal This approach aligns with Google Cloud security best practices by implementing identity-centric security, zero network exposure, and continuous compliance auditing.

StudyCerts

Iap Access Context Manager Zero Trust Audit Logging | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Iap Access Context Manager Zero Trust Audit Logging

Section: Security controls (e.g., auditing, VPC Service Controls, context aware access, organization policy, and hierarchical firewall policy)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is migrating sensitive internal web applications and Compute Engine instances to Google Cloud. The security team needs to implement a Zero Trust access architecture that meets the following criteria:

Administrators and developers must access internal web applications and connect to Compute Engine instances via SSH without exposing workloads to public IP addresses.
Access must be strictly conditioned on user identity and verified device posture telemetry (such as corporate-managed devices).
All administrative actions, configuration changes, and individual connection attempts (both successful and failed) must be captured for regulatory compliance and security analysis.

Which architecture should you implement to satisfy these requirements?

Deploy a dedicated bastion host VM with an external IP address, restrict incoming traffic using VPC firewall rules based on source IP CIDRs, and monitor user connections using default Cloud Audit Logs Admin Activity logs.

Provision a Cloud VPN gateway to connect developer workstations to the VPC, grant the Compute OS Admin Login role permanently to all developers, and capture network activity with VPC Flow Logs.

Deploy an external Application Load Balancer with Google Cloud Armor IP allowlists, delegate privileges using service account keys stored on developer endpoints, and rely on Security Command Center Event Threat Detection.

Configure Identity-Aware Proxy (IAP) for internal web apps and IAP TCP forwarding for SSH, enforce device posture using Access Context Manager access levels applied through IAM conditions, and enable Cloud Audit Logs Data Access logging.

Professional Cloud Architect

Iap Access Context Manager Zero Trust Audit Logging

Related questions