What should the customer do to meet these requirements?

A customer implements Cloud Identity-Aware Proxy for their ERP system hosted on Compute Engine. Their security team wants to add a security layer so that the ERP systems only accept traffic from Cloud Identity- Aware Proxy.

What should the customer do to meet these requirements?
A . Make sure that the ERP system can validate the JWT assertion in the HTTP requests.
B . Make sure that the ERP system can validate the identity headers in the HTTP requests.
C . Make sure that the ERP system can validate the x-forwarded-for headers in the HTTP requests.
D . Make sure that the ERP system can validate the user’s unique identifier headers in the HTTP requests.

Answer: A

Explanation:

Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed object that also contains the user identity data. Your application can verify the digital signature and use the data provided in this object to be certain that it was provided by IAP without alteration.