A service that controls access to applications and VMs based on identity and context, without a VPN. Its TCP forwarding lets you SSH or RDP into VMs without external IPs, allowing only the 35.235.240.0/20 range in the firewall.
On the ACE it answers "SSH into a VM with no external IP and no bastion": gcloud compute ssh --tunnel-through-iap and the IAP-secured Tunnel User role.
Identity-Aware Proxy (IAP) is a concept that can show up on the exam. Check the full guide to see it in context.