Build a Compute Engine-hosted corporate tool that authenticates users and restricts access to the finance department (all users are in G Suite). What should you do?

The correct option leverages Cloud IAP for authentication and authorization, which is ideal for G Suite users. Cloud IAP integrates directly with Google Groups, allowing you to easily restrict access to the finance department based on their existing G Suite group membership. Verifying the JWT in the application ensures that the user's identity and authorization are confirmed at the application layer, providing an additional layer of security and allowing the application to personalize content or further restrict features based on user attributes. The second option is less practical because issuing and managing client certificates for all finance team members is cumbersome compared to using G Suite groups with IAP. The third and fourth options use Cloud Armor, which is primarily for DDoS protection and IP-based access control, not for user-level authentication and authorization with G Suite identities. Restricting by corporate IP ranges doesn't authenticate individual users or their department.