A web app will serve HTTP/HTTPS from Compute Engine instances and you need occasional SSH from a remote laptop for maintenance while following Google best practices. How should you configure networking and access?
Choose an answer
Tap an option to check your answer.
Correct answer: Configure Cloud Identity-Aware Proxy API for SSH access. Then configure the Compute Engine servers with private IP addresses behind an HTTP(s) load balancer for the application web traffic..
Why this is the answer
This option correctly implements Google's best practices for secure access. Using an HTTP(S) load balancer with private IP Compute Engine instances is standard for web applications, providing scalability and security by not exposing instances directly. Cloud Identity-Aware Proxy (IAP) for SSH is the recommended secure method for remote access to instances without assigning public IPs or using a bastion host. The TCP proxy load balancer is for non-HTTP(S) traffic. Allowing all ingress traffic to servers with external IPs is a significant security risk. While a bastion host works, IAP for SSH is a more modern, fully managed, and secure Google Cloud best practice, eliminating the need to manage a separate bastion instance.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed