Teams use Linux instances on Google Cloud. Provide the most secure and cost-efficient method for engineer SSH access. What should you do?

The correct answer is to use gcloud compute ssh --tunnel-through-iap and permit TCP/22 from the IAP connector range. This method provides secure SSH access without requiring public IP addresses on your instances, reducing the attack surface. Cloud IAP (Identity-Aware Proxy) verifies user identity and context before granting access, acting as a centralized authorization layer. The specified IP range (35.235.240.0/20) is the official IP range for IAP-secured tunnels. Assigning public IPs and opening TCP/22 to the internet is insecure and exposes instances directly to the internet. Using a third-party remote access tool introduces external dependencies and potential security vulnerabilities. Deploying a public bastion host adds complexity, requires management, and still exposes an entry point to the internet, albeit a controlled one.