Google Cloud Certified Professional Cloud Security Engineer Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  On the Google exam (and in most cloud certifications), you often need to choose the most direct and specific technical control that solves the problem described in the question. In this question, the emphasis is on preventing external users from accessing the application, even if they steal an employee's password. IAP is a specific mechanism that: Restricts access to users from your organization only. Physically prevents unauthorized Google accounts from accessing the application. This is a cloud-native way to “cut off” external access. 2FA is a best practice, but on the exam it may be interpreted as a “general measure” rather than one specific to GCP/App Engine.

• Chose B1

  IAP Benefits: Zero-trust access control at the application level Verifies user identity and context before allowing access Blocks access even with valid credentials if context is suspicious Integration with Google Workspace for seamless user experience

• Chose B3

  B is correct Cloud Identity-Aware Proxy (IAP) enforces identity-based access controls directly at the application layer, ensuring that only authenticated and authorized users can access the App Engine application. It adds an additional security layer independent of the user’s credentials, thereby protecting the application even if an employee’s password is compromised. A is not sufficient because enforcing 2FA only protects the authentication process and does not provide the granular, context-aware access control that IAP offers.