Custom domains in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding DNS Records for Custom Domains

You want to connect your custom domain to a Google Cloud service. Which DNS record type is typically required to point your domain to a Google-managed service IP address?

A MX record

B A record

C TXT record

D CNAME record

💡 Hint

Think about the record that maps a domain to an IP address.

An A record maps a domain name to an IPv4 address, which is necessary to point your custom domain to the IP address of a Google Cloud service.

❓ Configuration

intermediate

Configuring a Custom Domain for App Engine

You want to configure a custom domain for your Google App Engine app. Which step is not required?

A Verify domain ownership in Google Search Console

B Create a DNS TXT record to prove ownership

C Add a DNS record pointing your domain to the App Engine service

D Set up a firewall rule to allow traffic from your domain

💡 Hint

Think about what is needed to connect a domain to a service versus network security settings.

Firewall rules control network traffic but are not required to configure a custom domain for App Engine. Domain verification and DNS records are required.

❓ Architecture

advanced

Designing a Secure Custom Domain Setup

You want to serve your website on a custom domain using Google Cloud Load Balancer with HTTPS. Which architecture ensures the best security and performance?

A Use a Google-managed SSL certificate on the load balancer and point your domain's A record to the load balancer IP

B Use a self-signed SSL certificate on backend instances and point your domain's CNAME to the backend IP

C Use HTTP only on the load balancer and redirect HTTPS traffic at the backend

D Use a third-party SSL certificate on backend instances and point your domain's MX record to the load balancer

💡 Hint

Consider where SSL termination should happen for best security and performance.

Google-managed SSL certificates on the load balancer provide automatic renewal and SSL termination at the edge, improving security and performance. The domain should point to the load balancer IP via an A record.

❓ service_behavior

advanced

Behavior of Custom Domain Mapping in Cloud Run

After mapping a custom domain to a Cloud Run service, what happens if you delete the DNS record pointing to the Cloud Run domain?

A Traffic is redirected to the default Cloud Run URL without interruption

B Cloud Run automatically updates DNS to restore the record

C The custom domain stops resolving to your Cloud Run service, causing downtime

D The service continues to respond on the custom domain without DNS

💡 Hint

Think about how DNS controls domain name resolution.

If the DNS record is deleted, the domain name no longer points to the Cloud Run service IP, so users cannot reach the service via the custom domain, causing downtime.

❓ security

expert

Preventing Domain Hijacking in Custom Domain Setup

Which practice best prevents unauthorized users from hijacking your custom domain when using Google Cloud services?

A Enable domain ownership verification and restrict DNS record changes to trusted users

B Use wildcard DNS records to cover all subdomains automatically

C Disable HTTPS to avoid certificate mismatches

D Share your Google Cloud credentials with your DNS provider

💡 Hint

Think about controlling who can prove ownership and change DNS settings.

Verifying domain ownership and restricting DNS changes to trusted users prevents attackers from redirecting your domain to malicious services.

Practice

1. What is the primary purpose of setting up a custom domain in Google Cloud Platform (GCP)?

easy

A. To use your own website address instead of a default GCP URL

B. To increase the storage capacity of your GCP project

C. To enable automatic backups for your cloud resources

D. To create virtual machines with custom names

Solution

1. Step 1: Understand what a custom domain is

   A custom domain lets you use your own website address instead of a generic cloud URL.

2. Step 2: Identify the purpose in GCP context

   In GCP, custom domains help users access services with familiar URLs, improving branding and trust.

3. Final Answer:

   To use your own website address instead of a default GCP URL -> Option A

4. Quick Check:

   Custom domain = personal website address [OK]

Hint: Custom domain means your own website address, not default URL [OK]

Common Mistakes:

• Confusing custom domain with storage or VM settings
• Thinking it changes backup or machine names
• Assuming it increases resource limits

2. Which DNS record type must you configure to point your custom domain to a Google App Engine service?

easy

A. MX record

B. TXT record

C. SRV record

D. CNAME record

Solution

1. Step 1: Identify DNS record types for domain pointing

   CNAME records map a domain or subdomain to another domain name, commonly used for pointing to cloud services.

2. Step 2: Match with Google App Engine requirements

   Google App Engine custom domains require CNAME records to link your domain to their service address.

3. Final Answer:

   CNAME record -> Option D

4. Quick Check:

   Point domain to service = CNAME record [OK]

Hint: Use CNAME to point domain to cloud service address [OK]

Common Mistakes:

• Using MX records which are for email routing
• Using TXT records meant for verification
• Confusing SRV records which are for service location

3. Given this snippet configuring a custom domain in GCP App Engine, what will happen if the DNS is not properly set?

gcloud app domain-mappings create example.com --certificate-management=automatic

medium

A. The command will fail with a syntax error

B. The domain will be mapped but users cannot access the app via example.com

C. The app will be accessible immediately without DNS changes

D. The SSL certificate will not be issued

Solution

1. Step 1: Understand domain mapping command effect

   The command creates a domain mapping and requests SSL certificate automatically.

2. Step 2: Consider DNS role in accessibility

   If DNS records do not point to GCP, users cannot reach the app via the custom domain despite mapping.

3. Final Answer:

   The domain will be mapped but users cannot access the app via example.com -> Option B

4. Quick Check:

   Mapping without DNS update = no access [OK]

Hint: Mapping alone doesn't work without DNS pointing [OK]

Common Mistakes:

• Assuming command fails without DNS
• Thinking app is accessible immediately
• Believing SSL won't issue without DNS

4. You tried to add a custom domain to your GCP App Engine app but received an error: "Domain ownership verification failed." What is the most likely cause?

medium

A. You did not add the required TXT record to your domain's DNS

B. You used an incorrect CNAME record type

C. Your App Engine app is not deployed

D. You forgot to enable billing on your GCP project

Solution

1. Step 1: Understand domain ownership verification process

   GCP requires you to prove you own the domain by adding a TXT record to DNS.

2. Step 2: Identify cause of verification failure

   If the TXT record is missing or incorrect, verification fails and domain cannot be added.

3. Final Answer:

   You did not add the required TXT record to your domain's DNS -> Option A

4. Quick Check:

   Missing TXT record = ownership verification fail [OK]

Hint: Verify domain by adding TXT record in DNS [OK]

Common Mistakes:

• Confusing CNAME with TXT for verification
• Assuming app deployment affects verification
• Thinking billing status causes verification error

5. You want to serve your website on both example.com and www.example.com using GCP App Engine with HTTPS. Which setup correctly achieves this with minimal manual DNS management?

hard

A. Map both domains; create TXT records for SSL; manually upload certificates

B. Map only example.com in App Engine; create A record for www pointing to example.com IP; manually manage SSL

C. Map both domains separately in App Engine and create CNAME for www pointing to ghs.googlehosted.com; use automatic SSL

D. Map www.example.com only; create CNAME for example.com pointing to www; disable SSL

Solution

1. Step 1: Understand domain mapping for root and www

   Both example.com and www.example.com need mapping to serve content on both URLs.

2. Step 2: Use recommended DNS and SSL setup

   Google recommends CNAME for www to ghs.googlehosted.com and automatic SSL management for ease and security.

3. Final Answer:

   Map both domains separately in App Engine and create CNAME for www pointing to ghs.googlehosted.com; use automatic SSL -> Option C

4. Quick Check:

   Separate mapping + CNAME + auto SSL = best practice [OK]

Hint: Map both domains and use CNAME for www with auto SSL [OK]

Common Mistakes:

• Using A record for www which is not recommended
• Mapping only one domain and missing the other
• Disabling SSL or managing certificates manually unnecessarily