nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #86

Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even…

The correct answer is A. Enforce 2-factor authentication in GSuite for all users. To prevent external users from accessing an internal App Engine application even if an employee's password is compromised, enforce 2-factor authentication in GSuite for all users.

Submitted by krish.m· Apr 18, 2026Configuring access within a cloud solution environment

Question

Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even when an employee's password has been compromised. What should you do?

Options

  • AEnforce 2-factor authentication in GSuite for all users.
  • BConfigure Cloud Identity-Aware Proxy for the App Engine Application.
  • CProvision user passwords using GSuite Password Sync.
  • DConfigure Cloud VPN between your private network and GCP.

How the community answered

(34 responses)
  • A
    82% (28)
  • B
    6% (2)
  • C
    9% (3)
  • D
    3% (1)

Why each option

To prevent external users from accessing an internal App Engine application even if an employee's password is compromised, enforce 2-factor authentication in GSuite for all users.

AEnforce 2-factor authentication in GSuite for all users.Correct

Enforcing 2-factor authentication (2FA) in GSuite directly addresses the risk of compromised passwords by requiring a second verification factor, ensuring that an external user cannot gain access to the application even with a stolen password.

BConfigure Cloud Identity-Aware Proxy for the App Engine Application.

Cloud Identity-Aware Proxy (IAP) protects web applications by controlling access based on user identity, but it relies on the underlying identity provider (GSuite) for authentication; if the GSuite password is compromised and 2FA is not enforced, IAP alone does not prevent access if the authentication succeeds.

CProvision user passwords using GSuite Password Sync.

GSuite Password Sync is a tool for synchronizing passwords from an on-premises directory to GSuite, not a security control to prevent unauthorized access in case of a compromised password.

DConfigure Cloud VPN between your private network and GCP.

Cloud VPN establishes a secure connection between on-premises and GCP networks but does not protect access to a publicly accessible App Engine application based on individual user identity and authentication credentials.

Concept tested: Multi-factor authentication for identity security

Source: https://support.google.com/a/answer/175197

Topics

#Two-Factor Authentication (2FA)#Identity and Access Management (IAM)#App Engine Security#Compromised Credentials Protection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice