Exam Professional Cloud Security Engineer topic 1 question 8 discussion

A is right see : https://cloud.google.com/iap/docs/signed-headers-howto

Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed object that also contains the user identity data. Your application can verify the digital signature and use the data provided in this object to be certain that it was provided by IAP without alteration. So answer is A

Cloud Identity-Aware Proxy (IAP) and Identity Headers: When IAP intercepts a request to your ERP system, it adds special identity headers to the HTTP request. These headers contain information about the authenticated user, such as their email address and group memberships. Validating Headers: Your ERP system needs to be configured to read and validate these identity headers. This allows the ERP system to: Confirm the user's identity: Verify that the user has been authenticated by IAP. Enforce authorization: Use the information in the headers (like group membership) to determine what the user is allowed to do within the ERP system. Why other options are incorrect: A. JWT Assertion: While IAP can use JWTs, it primarily relies on identity headers for this type of authentication.

How is A, A talks about using JWT which is used for signed headers in IAP and B talks about actual header which we get when using IAP so B is correct not A

The answer is B. The question says ONLY from IAP! what will prevent me from sending the request with JWT in the header without IAP?? Validating the JWT assertion can be part of the overall authentication and authorization process in the ERP system. However, to specifically enforce that traffic is coming from Cloud Identity-Aware Proxy, validating the identity headers added by IAP is more appropriate. These headers contain information about the authenticated user and the authentication method used by Cloud Identity-Aware Proxy. By validating these headers, the ERP system can verify that the request originated from Cloud Identity-Aware Proxy, which acts as the front-end for authentication and access control.

The correct answer is A

Agree A makes more sense

Ans is A

A is correct option here.

A is the one

Ans is A