Objective 1.3
PCSEManaging authentication
Objective 1.3 sits in Configuring access, which carries 25% of the Cloud Security Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.
Objective title verbatim from the official objectives. Google Cloud exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An administrator protects a Compute Engine web app with IAP and then finds that a process running on that same VM reaches the app unchallenged. Why?
Correct.
Concept
A proxy can only govern traffic that has to pass through it. Anything already inside the trust boundary reaches the listener directly, so the proxy is a perimeter rather than a local access control.
Why B
Users who can reach the application-serving port of the VM can bypass IAP authentication, and Compute Engine and GKE firewall rules cannot protect against access from code running on the same VM.
Source
Google Cloud: Identity-Aware Proxy overview, checked August 2026If you're using Compute Engine or Google Kubernetes Engine, users who can access the application-serving port of the Virtual Machine (VM) can bypass IAP authentication. Compute Engine and GKE firewall rules can't protect against access from code running on the same VM as the IAP-secured application. Firewall rules can protect against access from another VM, but only if properly configured.
Now you: objective 1.3 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team tidying up unused credentials in APIs and services deletes an OAuth 2.0 client that nobody recognised. Their IAP-protected app then stops working. What did they remove?
Sample question 2 of 3
A user signs in successfully through IAP but still receives a refusal from the protected application. Which grant is missing?
Sample question 3 of 3
An engineer fronts a Cloud Run service with a global load balancer and plans to enable IAP. Which configuration should be avoided?
Full Cloud Security Engineer question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.