You want to enable fine-grained access control for applications running on your GKE cluster. Which of the following GCP services should you integrate with GKE?

Cloud Identity-Aware Proxy (IAP) is the correct choice because it allows you to establish a central authorization layer for applications accessed via HTTPS, enabling fine-grained, context-aware access control based on user identity and request attributes. It integrates directly with GKE applications, securing them without requiring VPNs or complex network configurations. Cloud Endpoints is for API management, not fine-grained access control for applications. Google Cloud Armor with IAM provides DDoS protection and WAF capabilities, but its IAM integration primarily controls access to Armor policies, not directly to application resources at a fine-grained level. Google Cloud Directory Sync synchronizes directories, not an access control mechanism. Anthos Config Management manages configurations across clusters, not user access to applications.