You are a member of your company's security team.

Vendor: Google
Product: Professional-Cloud-Security-Engineer
Update on: Sep 16, 2025
Questions: 266

Google Professional-Cloud-Security-Engineer Question Answer

You are a member of your company's security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from public locations so they can access the internal VPC while off-site. How should you enable this access?

Implement Cloud VPN for the region where the bastion host lives.

Implement OS Login with 2-step verification for the bastion host.

Implement Identity-Aware Proxy TCP forwarding for the bastion host.

Implement Google Cloud Armor in front of the bastion host.