Exam Professional Cloud Security Engineer topic 1 question 44 discussion

A. Enforce 2-factor authentication in GSuite for all users.

B is correct Cloud Identity-Aware Proxy (IAP) enforces identity-based access controls directly at the application layer, ensuring that only authenticated and authorized users can access the App Engine application. It adds an additional security layer independent of the user’s credentials, thereby protecting the application even if an employee’s password is compromised. A is not sufficient because enforcing 2FA only protects the authentication process and does not provide the granular, context-aware access control that IAP offers.

Default IAP Configuration: By default, IAP requires users to be authenticated with Google accounts, but this authentication might only involve a username and password unless 2FA is specifically enforced for those accounts by the organization's security policies in Google Workspace or Cloud Identity.

I go with B. IAP is zero trust and context aware

I go with B. IAP is zero trust and context aware

I also feel, it's B. As even if password is compromised, we can block based on IP ranges, geolocation, etc

A Cloud VPN creates a secure tunnel between your network and GCP, but it wouldn't restrict access based on individual user identities.

2FA adds an extra layer of security, but if an external user has both the password and the second factor (e.g., a verification code), they might still gain access. So my answer is B. All external users will be blocked with the right authentication or not

A is the answer.

Right Answer is A

Correct Answer A

A is the answer.

https://support.google.com/a/answer/175197?hl=en

Shouldn't it be B. Configure Cloud Identity-Aware Proxy for the App Engine Application. identity based app access

The key is external user. Best practice is to have internal users/datacenter connect via VPN for security purpose, correct? External users will try to connect via Internet - they still cannot reach the app engine even if they have a users' password because a VPN connection is need to reach the resource. MA will work IF the external user has VPN access... But I think D is what they're looking for based on the question....

Ans : A. When passwords is compromised, enforcing 2 factor authentication is the best way to prevent non authorized users.

Enforcing 2-factor authentication can save an employee's password has been compromised