Google
PROFESSIONAL-CLOUD-ARCHITECT · Question #226
You have deployed several instances on Compute Engine. As a security requirement, instances cannot have a public IP address. There is no VPN connection between Google Cloud and your office, and you…
The correct answer is C. Configure Identity-Aware Proxy (IAP) for the instance and ensure that you have the role of IAP-. https://cloud.google.com/iap/docs/using-tcp-forwarding#tunneling_with_ssh
Submitted by haruto_sh· Mar 30, 2026Designing for security and compliance
Question
You have deployed several instances on Compute Engine. As a security requirement, instances cannot have a public IP address. There is no VPN connection between Google Cloud and your office, and you need to connect via SSH into a specific machine without violating the security requirements. What should you do?
Options
- AConfigure Cloud NAT on the subnet where the instance is hosted.
- BAdd all instances to an unmanaged instance group.
- CConfigure Identity-Aware Proxy (IAP) for the instance and ensure that you have the role of IAP-
- DCreate a bastion host in the network to SSH into the bastion host from your office location.
How the community answered
(44 responses)- A5% (2)
- B2% (1)
- C91% (40)
- D2% (1)
Explanation
https://cloud.google.com/iap/docs/using-tcp-forwarding#tunneling_with_ssh
Topics
#Identity-Aware Proxy#SSH access#no public IP#Compute Engine
Community Discussion
No community discussion yet for this question.