An enterprise is migrating its sensitive database administration and operations workloads to Google Cloud. The architecture includes several Compute Engine virtual machines (VMs) deployed with only internal RFC 1918 IP addresses in private subnets. The security and network teams have defined the following operational requirements: Remote system administrators must be able to establish administrative SSH sessions to the internal Linux VMs without assigning external IP addresses to the instances. Traditional perimeter-based VPN tunnels, direct internet exposure, and dedicated bastion jump hosts must be eliminated to minimize the attack surface. Access must be enforced at the identity layer, requiring administrative users to authenticate via Google credentials and be evaluated against Identity and Access Management (IAM) permissions and context-aware policies before connection establishment. All connection attempts and administrative access sessions must generate audit logs. Which solution should the cloud architect implement to meet these requirements?

Configure Identity-Aware Proxy (IAP) TCP forwarding, assign the `roles/iap.tunnelResourceAccessor` role to administrators, and connect using `gcloud compute ssh` with the `--tunnel-through-iap` flag: ### What Identity-Aware Proxy (IAP) TCP Forwarding Is **Identity-Aware Proxy (IAP) TCP forwarding** is a Google Cloud service that enables users to establish encrypted tunnels to internal Compute Engine VM instances over **TCP port 22 (SSH)** or **port 3389 (RDP)** without allocating public IPv4 addresses to the instances or configuring client VPN infrastructure. ### How It Meets the Requirements - **Eliminating external IPs and bastion hosts**: IAP acts as a managed intermediary proxy at Google's network edge. Administrative connections are directed through Google APIs rather than reaching public endpoints directly, allowing internal Linux VMs to remain strictly private. - **Identity-based access control**: Users must successfully authenticate with their **Google Cloud credentials**. Access is governed by the **IAP-secured Tunnel User** role (`roles/iap.tunnelResourceAccessor`) defined in **Identity and Access Management (IAM)** policies. - **Context-aware evaluation**: IAP integrates natively with **Access Context Manager** and **Chrome Enterprise Premium** to evaluate context signals such as client IP address, geographic location, and device security posture before establishing the tunnel. - **Comprehensive auditing**: All connection authorizations, successes, and rejections are recorded in **Cloud Audit Logs** (specifically data access logs). ### Key Advantages and Capabilities - **Zero-Trust network architecture**: Replaces coarse-grained network perimeter access with fine-grained, identity-verified and context-validated access per instance. - **Seamless client tooling**: Integrates directly with the standard Google Cloud SDK command `gcloud compute ssh --tunnel-through-iap` as well as tools like **IAP Desktop** and **PuTTY**. - **Reduced infrastructure management**: Eliminates the operational overhead, patching burden, and compute costs associated with running dedicated bastion hosts. - **Strict firewall segmentation**: Requires only a single ingress firewall rule allowing traffic from Google's IAP netblock (`35.235.240.0/20`) to internal instances on port 22. ### Why This Is Optimal Compared to perimeter VPNs or exposed bastion hosts, IAP TCP forwarding provides a cloud-native, centrally managed identity proxy that enforces strong authentication and context validation before any TCP packet reaches the target VM.

StudyCerts

Iap Tcp Forwarding Secure Ssh Access | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Iap Tcp Forwarding Secure Ssh Access

Section: Security protection (e.g. intrusion protection, access control, and firewalls)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is migrating its sensitive database administration and operations workloads to Google Cloud. The architecture includes several Compute Engine virtual machines (VMs) deployed with only internal RFC 1918 IP addresses in private subnets.

The security and network teams have defined the following operational requirements:

Remote system administrators must be able to establish administrative SSH sessions to the internal Linux VMs without assigning external IP addresses to the instances.
Traditional perimeter-based VPN tunnels, direct internet exposure, and dedicated bastion jump hosts must be eliminated to minimize the attack surface.
Access must be enforced at the identity layer, requiring administrative users to authenticate via Google credentials and be evaluated against Identity and Access Management (IAM) permissions and context-aware policies before connection establishment.
All connection attempts and administrative access sessions must generate audit logs.

Which solution should the cloud architect implement to meet these requirements?

Deploy a dedicated bastion host VM configured with an external IP address, enable Cloud NAT on the VPC network, and restrict inbound SSH access using source-tagged firewall rules

Configure Identity-Aware Proxy (IAP) TCP forwarding, assign the roles/iap.tunnelResourceAccessor role to administrators, and connect using gcloud compute ssh with the --tunnel-through-iap flag

Configure an Internal Regional Application Load Balancer with Identity-Aware Proxy (IAP) enabled on its backend service and configure SAML attribute propagation

Provision a Private Service Connect (PSC) endpoint in the consumer VPC pointing to an Apigee service attachment and require all administrators to authenticate using Identity Platform ID tokens

Professional Cloud Architect

Iap Tcp Forwarding Secure Ssh Access

Related questions