GCP Professional Cloud Architect Practice Question

Your company runs an internal dashboard on GKE that is published through an external HTTP(S) load balancer with a public IP address. The security policy states:

Only corporate employees may reach the dashboard from any network.
Access must be denied from laptops that are not compliant with corporate device policies.
No VPN clients or per-device certificates may be required.

As the Cloud Architect, which solution best satisfies these requirements while keeping operational overhead low?

Enable Identity-Aware Proxy on the HTTP(S) load balancer and create a context-aware access policy that permits only members of the corporate Workspace group on managed devices verified by Chrome Enterprise Premium.
Configure IAP TCP forwarding to a bastion host, force users to establish an SSH tunnel to the dashboard, and permit access only to the corporate group.
Protect the load balancer with Cloud Armor by allow-listing corporate office IP ranges and enforce basic authentication on the application.
Require users to connect through Cloud VPN to a private VPC that exposes the dashboard via an internal load balancer, and restrict firewall rules to the VPN subnet.

Report Issue

Answer Description

Identity-Aware Proxy (IAP) can front an external HTTP(S) load balancer and evaluate every request against an Access Context Manager policy. By allowing only identities in a corporate Google Workspace group and requiring devices that report compliance through Endpoint Verification (a Chrome Enterprise Premium capability), the dashboard is accessible solely to authorized, policy-compliant users. No VPN software or certificates are needed.

Cloud VPN violates the explicit "no VPN" requirement. Relying on Cloud Armor IP allowlists enforces network location but provides neither identity nor device checks and is hard to maintain for roaming users. IAP TCP forwarding through an SSH bastion could enforce the same context-aware policies, but it forces users to establish and maintain SSH tunnels and does not meet the stated requirement in the option text for device compliance, resulting in higher user friction and operational overhead.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.