You must migrate an intranet web app to Google Cloud so only employees can access it remotely with minimal app changes. What should you do?

Identity-Aware Proxy (IAP) is the correct solution because it allows secure access to internal web applications from the internet without requiring VPNs or extensive application modifications. IAP integrates with Google Cloud's identity and access management (IAM) system, authenticating users against their corporate accounts (e.g., Google Workspace) and then authorizing access based on IAM policies. This fulfills the requirement for remote access by employees with minimal app changes. Configuring the application to check authentication credentials for each HTTP(S) request would require significant modifications to the application itself. The other two incorrect options describe setting up a custom proxy on a Compute Engine instance, which is more complex, less secure, and less scalable than IAP, and would still require managing the proxy server. Additionally, redirecting to a public IP address (as in the last option) would expose the application directly, defeating the purpose of a secure access solution.