Professional Cloud Security EngineerDemo

Question

Your organization runs an application on Cloud Run. You need to control access to the application with Cloud Identity-Aware Proxy (IAP) and meet these requirements:

Only users in the AppDev group can access it.
Access must be limited to internal network IP addresses.

What should you do?

A Deploy a VPN gateway and instruct the AppDev group to connect to the company network before accessing the application.
B Create an access level that includes conditions for internal IP address ranges and AppDev groups. Apply this access level to the application's IAP policy.
C Configure firewall rules to limit access to IAP based on the AppDev group and source IP addresses.
D Configure IAP to enforce multi-factor authentication (MFA) for all users and use network intrusion detection systems (NIDS) to block unauthorized access attempts.

Explanation

IAP policies can grant access to a Google group, while Context-Aware Access access levels can restrict access by IP address. Binding the AppDev group to the IAP-protected application with an access level that permits only the internal IP ranges enforces both identity-based and network-context requirements.

Learn more

Professional Cloud Security EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ234

Community Discussion