Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ157

Securing communications and establishing boundary protection

You are part of your company’s security team. You have been asked to reduce the external attack surface of your Linux bastion host by removing every public IP address. Site Reliability Engineers (SREs) need to reach the bastion host from public locations so they can access the internal VPC while off-site. How should you provide this access?

  • A Implement Cloud VPN for the region where the bastion host lives.
  • B Implement OS Login with 2-step verification for the bastion host.
  • C Implement Identity-Aware Proxy TCP forwarding for the bastion host.
  • D Implement Google Cloud Armor in front of the bastion host.
Explanation

Identity-Aware Proxy (IAP) TCP forwarding creates an encrypted, IAM-controlled tunnel for administrative services such as SSH to a VM’s internal IP address. It allows authorized SREs to access the bastion from the public internet without assigning the bastion a public, routable IP address.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!