Your organization hosts a sensitive internal administrative web application on Google Kubernetes Engine (GKE) behind an External HTTP(S) Load Balancer, along with private Compute Engine virtual machines (VMs) that administrators manage using SSH. Your security team mandates the following requirements: Administrative web interfaces and VM instances must not be exposed directly to the public internet using public IP addresses. Access must be authenticated centrally without requiring an enterprise VPN. Only authorized users operating corporate-managed devices that meet specific device posture health criteria and originate from approved geographic locations can connect. Which architecture should you implement?

Enable Identity-Aware Proxy (IAP) on the load balancer backend service and use IAP TCP forwarding for VM SSH access. Define access levels in Access Context Manager using Chrome Enterprise Premium device posture and geographic criteria, and enforce them using IAM conditions.: ### What Identity-Aware Proxy and Context-Aware Access provide **Identity-Aware Proxy (IAP)** provides a zero-trust application and administrative access layer by establishing identity-centric controls instead of traditional network-level perimeters. In conjunction with **Access Context Manager** and **Chrome Enterprise Premium**, IAP evaluates contextual signals—such as identity, geographic location, and device security posture—before proxying any traffic to backend services. ### How it meets the requirements - **Securing web and administrative interfaces without public exposure:** IAP attaches directly to the **External HTTP(S) Load Balancer** to protect web applications and uses **IAP TCP forwarding** to tunnel SSH traffic directly to private VM internal IP addresses (`nic0`), removing the need for external IPs on Compute Engine instances. - **VPN-less authentication:** IAP intercepts incoming requests and validates identity centrally using Google credentials, eliminating the overhead of managing corporate VPN tunnels. - **Device posture and location verification:** **Chrome Enterprise Premium** feeds rich endpoint posture signals into **Access Context Manager**. Defining access levels with device health attributes (e.g., encryption, OS version) and geographic origin, and binding them via **IAM conditions** (such as `request.auth.access_levels`), ensures only compliant corporate devices from authorized regions gain access. ### Key advantages and capabilities - **Zero-trust perimeter:** Enforces granular, context-aware policy checks on every connection request. - **Reduced attack surface:** Eliminates bastion host maintenance and closes public internet port exposures (e.g., port 22 and port 443). - **Centralized auditing:** Generates detailed Cloud Audit Logs recording user identity, client context, and resource access attempts. ### Why this is optimal This approach directly satisfies all zero-trust criteria without introducing complex network routing, custom reverse proxies, or dedicated jump hosts.

StudyCerts

Iap Context Aware Access Chrome Enterprise Premium | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Iap Context Aware Access Chrome Enterprise Premium

Section: Secure remote access (e.g., Identity-Aware Proxy, service account impersonation, Chrome Enterprise Premium, and Workload Identity Federation)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization hosts a sensitive internal administrative web application on Google Kubernetes Engine (GKE) behind an External HTTP(S) Load Balancer, along with private Compute Engine virtual machines (VMs) that administrators manage using SSH.

Your security team mandates the following requirements:

Administrative web interfaces and VM instances must not be exposed directly to the public internet using public IP addresses.
Access must be authenticated centrally without requiring an enterprise VPN.
Only authorized users operating corporate-managed devices that meet specific device posture health criteria and originate from approved geographic locations can connect.

Which architecture should you implement?

Configure Google Cloud Armor security policies on the External HTTP(S) Load Balancer with geo-blocking rules, and assign the Compute OS Admin Login role to administrators for direct VM access.

Deploy a dedicated bastion host with a public IP address in a perimeter subnet, enforce OS Login with 2-step verification for SSH access, and configure VPC firewall rules to restrict traffic to corporate office CIDR ranges.

Deploy a Cloud VPN gateway between remote worker environments and the VPC, configure private DNS zones, and restrict access using subnet-level Network Security Groups and IAM permissions.

Enable Identity-Aware Proxy (IAP) on the load balancer backend service and use IAP TCP forwarding for VM SSH access. Define access levels in Access Context Manager using Chrome Enterprise Premium device posture and geographic criteria, and enforce them using IAM conditions.

Professional Cloud Architect

Iap Context Aware Access Chrome Enterprise Premium

Related questions