Professional Cloud Security EngineerDemo

Question

You operate a web application on Cloud Run that is internet-exposed through an Application Load Balancer. You need to ensure that only privileged users in your organization can access the application. The proposed solution must support browser-based access with single sign-on. What should you do?

A Change Cloud Run configuration to require authentication. Assign the role of Cloud Run Invoker to the group of privileged users.
B Create a group of privileged users in Cloud Identity. Assign the role of Cloud Run User to the group directly on the Cloud Run service.
C Change the Ingress Control configuration of Cloud Run to internal and create firewall rules to allow only access from known IP addresses.
D Activate Identity-Aware Proxy (IAP) on the Application Load Balancer backend. Assign the role of IAP-secured Web App User to the group of privileged users.

Explanation

Identity-Aware Proxy authenticates browser users and enforces IAM authorization before requests reach an Application Load Balancer backend. Assigning the privileged group the IAP-secured Web App User role restricts access to that group while providing single sign-on. The IAP service agent must also be authorized to invoke the Cloud Run backend.

Learn more

Professional Cloud Security EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ287

Community Discussion