Exam Professional Cloud Security Engineer topic 1 question 119 discussion

The answer is clear in this case.

To enable access to the bastion host from public locations while reducing the Linux bastion host external attack surface by removing all public IP addresses, you should implement Identity-Aware Proxy TCP forwarding for the bastion host. This will allow Site Reliability Engineers (SREs) to access the internal VPC while off-site. Identity-Aware Proxy TCP forwarding allows you to securely access TCP-based applications such as SSH and RDP without exposing them to the internet. It provides a secure way to access your applications by verifying user identity and context of the request before granting access. By implementing Identity-Aware Proxy TCP forwarding for the bastion host, you can ensure that only authorized users can access the internal VPC while off-site, reducing the risk of unauthorized access and data breaches.

C is correct

C. Implement Identity-Aware Proxy TCP forwarding for the bastion host.

Correct. Ref.https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms#configuring_iap_tunnels_for_interacting_with_instances