GCP Professional Cloud Security Engineer Practice Question

Identity-Aware Proxy (IAP) can sit in front of an external HTTP(S) load balancer and evaluate each request against IAM policy and context-aware access levels. By combining an IAP-secured Web App User role with access levels that check user group membership, device posture, and time-based conditions, you achieve a zero-trust model without altering the application or requiring a VPN. Cloud Armor inspects L7 traffic but cannot enforce identity or device context. VPC firewall rules filter only on IP, protocol, and tags, not on user or device attributes. Private Service Connect provides private networking paths but leaves authentication and contextual enforcement to the backend, so it does not natively satisfy the stated requirements.