An enterprise is migrating its sensitive database administration and operations workloads to Google Cloud. The architecture includes several Compute Engine virtual machines (VMs) deployed with only internal RFC 1918 IP addresses in private subnets. The security and network teams have defined the following operational requirements: Remote system administrators must be able to establish administrative SSH sessions to the internal Linux VMs without assigning external IP addresses to the instances. Traditional perimeter-based VPN tunnels, direct internet exposure, and dedicated bastion jump hosts must be eliminated to minimize the attack surface. Access must be enforced at the identity layer, requiring administrative users to authenticate via Google credentials and be evaluated against Identity and Access Management (IAM) permissions and context-aware policies before connection establishment. All connection attempts and administrative access sessions must generate audit logs. Which solution should the cloud architect implement to meet these requirements?

Configure Identity-Aware Proxy (IAP) TCP forwarding, assign the `roles/iap.tunnelResourceAccessor` role to administrators, and connect using `gcloud compute ssh` with the `--tunnel-through-iap` flag: What Identity-Aware Proxy (IAP) TCP Forwarding Is Identity-Aware Proxy (IAP) TCP forwarding is a Google Cloud service that enables users to establish encrypted tunnels to internal Compute Engine VM instances over TCP port 22 (SSH) or port 3389 (RDP) without allocating public IPv4 addresses to the instances or configuring client VPN infrastructure. How It Meets the Requirements Eliminating external IPs and bastion hosts: IAP acts as a managed intermediary proxy at Google's network edge. Administrative connections are directed through Google APIs rather than reaching public endpoints directly, allowing internal Linux VMs to remain strictly private. Identity-based access control: Users must successfully authenticate with their Google Cloud credentials. Access is governed by the IAP-secured Tunnel User role (roles/iap.tunnelResourceAccessor) defined in Identity and Access Management (IAM) policies. Context-aware evaluation: IAP integrates natively with Access Context Manager and Chrome Enterprise Premium to evaluate context signals such as client IP address, geographic location, and device security posture before establishing the tunnel. Comprehensive auditing: All connection authorizations, successes, and rejections are recorded in Cloud Audit Logs (specifically data access logs). Key Advantages and Capabilities Zero-Trust network architecture: Replaces coarse-grained network perimeter access with fine-grained, identity-verified and context-validated access per instance. Seamless client tooling: Integrates directly with the standard Google Cloud SDK command gcloud compute ssh --tunnel-through-iap as well as tools like IAP Desktop and PuTTY. Reduced infrastructure management: Eliminates the operational overhead, patching burden, and compute costs associated with running dedicated bastion hosts. Strict firewall segmentation: Requires only a single ingress firewall rule allowing traffic from Google's IAP netblock (35.235.240.0/20) to internal instances on port 22. Why This Is Optimal Compared to perimeter VPNs or exposed bastion hosts, IAP TCP forwarding provides a cloud-native, centrally managed identity proxy that enforces strong authentication and context validation before any TCP packet reaches the target VM.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Iap Tcp Forwarding Secure Ssh Access

Section: Security protection (e.g. intrusion protection, access control, and firewalls)

An enterprise is migrating its sensitive database administration and operations workloads to Google Cloud. The architecture includes several Compute Engine virtual machines (VMs) deployed with only internal RFC 1918 IP addresses in private subnets.

The security and network teams have defined the following operational requirements:

Remote system administrators must be able to establish administrative SSH sessions to the internal Linux VMs without assigning external IP addresses to the instances.
Traditional perimeter-based VPN tunnels, direct internet exposure, and dedicated bastion jump hosts must be eliminated to minimize the attack surface.
Access must be enforced at the identity layer, requiring administrative users to authenticate via Google credentials and be evaluated against Identity and Access Management (IAM) permissions and context-aware policies before connection establishment.
All connection attempts and administrative access sessions must generate audit logs.

Which solution should the cloud architect implement to meet these requirements?

Provision a Private Service Connect (PSC) endpoint in the consumer VPC pointing to an Apigee service attachment and require all administrators to authenticate using Identity Platform ID tokens

Configure Identity-Aware Proxy (IAP) TCP forwarding, assign the roles/iap.tunnelResourceAccessor role to administrators, and connect using gcloud compute ssh with the --tunnel-through-iap flag

Configure an Internal Regional Application Load Balancer with Identity-Aware Proxy (IAP) enabled on its backend service and configure SAML attribute propagation

Deploy a dedicated bastion host VM configured with an external IP address, enable Cloud NAT on the VPC network, and restrict inbound SSH access using source-tagged firewall rules

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Iap Tcp Forwarding Secure Ssh Access

Section: Security protection (e.g. intrusion protection, access control, and firewalls)

The security and network teams have defined the following operational requirements:

Remote system administrators must be able to establish administrative SSH sessions to the internal Linux VMs without assigning external IP addresses to the instances.
Traditional perimeter-based VPN tunnels, direct internet exposure, and dedicated bastion jump hosts must be eliminated to minimize the attack surface.
Access must be enforced at the identity layer, requiring administrative users to authenticate via Google credentials and be evaluated against Identity and Access Management (IAM) permissions and context-aware policies before connection establishment.
All connection attempts and administrative access sessions must generate audit logs.

Which solution should the cloud architect implement to meet these requirements?

Provision a Private Service Connect (PSC) endpoint in the consumer VPC pointing to an Apigee service attachment and require all administrators to authenticate using Identity Platform ID tokens

Configure Identity-Aware Proxy (IAP) TCP forwarding, assign the roles/iap.tunnelResourceAccessor role to administrators, and connect using gcloud compute ssh with the --tunnel-through-iap flag

Configure an Internal Regional Application Load Balancer with Identity-Aware Proxy (IAP) enabled on its backend service and configure SAML attribute propagation

Deploy a dedicated bastion host VM configured with an external IP address, enable Cloud NAT on the VPC network, and restrict inbound SSH access using source-tagged firewall rules

Explanations

What Identity-Aware Proxy (IAP) TCP Forwarding Is

Identity-Aware Proxy (IAP) TCP forwarding is a Google Cloud service that enables users to establish encrypted tunnels to internal Compute Engine VM instances over TCP port 22 (SSH) or port 3389 (RDP) without allocating public IPv4 addresses to the instances or configuring client VPN infrastructure.

How It Meets the Requirements

Eliminating external IPs and bastion hosts: IAP acts as a managed intermediary proxy at Google's network edge. Administrative connections are directed through Google APIs rather than reaching public endpoints directly, allowing internal Linux VMs to remain strictly private.
Identity-based access control: Users must successfully authenticate with their Google Cloud credentials. Access is governed by the IAP-secured Tunnel User role (roles/iap.tunnelResourceAccessor) defined in Identity and Access Management (IAM) policies.
Context-aware evaluation: IAP integrates natively with Access Context Manager and Chrome Enterprise Premium to evaluate context signals such as client IP address, geographic location, and device security posture before establishing the tunnel.
Comprehensive auditing: All connection authorizations, successes, and rejections are recorded in Cloud Audit Logs (specifically data access logs).

Key Advantages and Capabilities

Zero-Trust network architecture: Replaces coarse-grained network perimeter access with fine-grained, identity-verified and context-validated access per instance.
Seamless client tooling: Integrates directly with the standard Google Cloud SDK command gcloud compute ssh --tunnel-through-iap as well as tools like IAP Desktop and PuTTY.
Reduced infrastructure management: Eliminates the operational overhead, patching burden, and compute costs associated with running dedicated bastion hosts.
Strict firewall segmentation: Requires only a single ingress firewall rule allowing traffic from Google's IAP netblock (35.235.240.0/20) to internal instances on port 22.

Why This Is Optimal

Compared to perimeter VPNs or exposed bastion hosts, IAP TCP forwarding provides a cloud-native, centrally managed identity proxy that enforces strong authentication and context validation before any TCP packet reaches the target VM.

View source documentation

Professional Cloud Architect

Iap Tcp Forwarding Secure Ssh Access

Professional Cloud Architect

Iap Tcp Forwarding Secure Ssh Access

What Identity-Aware Proxy (IAP) TCP Forwarding Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions