You work in an international company and manage many GCP Compute Engine instances using SSH and RDS protocols.The management, for security reasons, asks you that VMs cannot have multiple public IP…

The correct answer is C. IAP's TCP forwarding. IAP-Identity-Aware Proxy is a service that lets you use SSH and RDP on your GCP VMs from the public internet, wrapping traffic in HTTPS and validating user access with IAM. Inside GCP there is a Proxy server with a listener that translates the communication and lets you operate…

Submitted by fatema_kw· Mar 30, 2026Designing for security and compliance

Question

You work in an international company and manage many GCP Compute Engine instances using SSH and RDS protocols.The management, for security reasons, asks you that VMs cannot have multiple public IP addresses. So you are actually no longer able to manage these VMs. How is it possible to manage in a simple and secure way, respecting the company rules, access and operations with these systems?

Options

ABastion Hosts
BNat Instances
CIAP's TCP forwarding
DSecurity Command Center

How the community answered

(71 responses)

A
1% (1)
B
1% (1)
C
92% (65)
D
6% (4)

Explanation

IAP-Identity-Aware Proxy is a service that lets you use SSH and RDP on your GCP VMs from the public internet, wrapping traffic in HTTPS and validating user access with IAM. Inside GCP there is a Proxy server with a listener that translates the communication and lets you operate in a safe way without the public exposure of your GCP resources. A is wrong because a Bastion Host needs a Public IP, so it is not feasible. B is wrong because a Nat Instance needs a Public IP, too. In addition, it is aimed at outgoing connectivity to the internet, blocking inbound traffic, thus preventing exactly what we need. D is wrong because Security Command Center is a reporting service for security that offers monitoring against vulnerabilities and threats.

Topics

#IAP TCP forwarding#private VM access#bastion host alternatives#Compute Engine security

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-ARCHITECT Practice