SSL certificates management in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Google Cloud Load Balancer handle SSL certificates?

When you attach an SSL certificate to a Google Cloud HTTPS Load Balancer, what happens when the certificate expires?

A The load balancer continues serving HTTPS traffic but browsers show a security warning.

B The load balancer automatically renews the certificate without user intervention.

C The load balancer switches to HTTP traffic automatically to avoid errors.

D The load balancer stops serving HTTPS traffic until a new certificate is uploaded.

💡 Hint

Think about what happens when a browser checks a certificate that is no longer valid.

When an SSL certificate expires, the load balancer still serves HTTPS traffic, but browsers detect the expired certificate and warn users. The load balancer does not automatically renew certificates or switch protocols.

❓ Configuration

intermediate

Correct JSON format for uploading a managed SSL certificate in GCP

You want to create a managed SSL certificate resource in Google Cloud using JSON. Which JSON snippet correctly defines the domains for the certificate?

A { "name": "my-cert", "managed": { "domains": "example.com, www.example.com" } }

B { "name": "my-cert", "managed": { "domains": ["example.com www.example.com"] } }

C { "name": "my-cert", "managed": { "domain": "example.com,www.example.com" } }

D { "name": "my-cert", "managed": { "domains": ["example.com", "www.example.com"] } }

💡 Hint

Remember that domains should be a list of strings, not a single string.

The correct format uses a JSON array for the domains field. Options A, B, and D use incorrect types or formats for the domains.

❓ Architecture

advanced

Best architecture for automatic SSL certificate renewal in GCP

You want to design a system that automatically provisions and renews SSL certificates for multiple domains on Google Cloud. Which architecture best supports this?

A Use Cloud DNS with manual certificate uploads to App Engine, renewing certificates via scripts.

B Use Google-managed SSL certificates attached to a Cloud Load Balancer for each domain, letting Google handle renewals.

C Manually upload self-managed certificates to Compute Engine instances and renew them using cron jobs.

D Use third-party certificate providers and manually update certificates in Cloud Storage buckets.

💡 Hint

Consider which option minimizes manual work and leverages Google Cloud's automation.

Google-managed SSL certificates automatically renew and integrate with Cloud Load Balancers, making option B the best architecture for automatic renewal.

❓ security

advanced

Security risk of using self-managed SSL certificates on Google Cloud

What is a key security risk when using self-managed SSL certificates on Google Cloud compared to Google-managed certificates?

A Self-managed certificates automatically renew, which can lead to unauthorized renewals.

B Self-managed certificates cannot be used with HTTPS Load Balancers, reducing security.

C Self-managed certificates may expire unnoticed, causing service interruptions and security warnings.

D Google-managed certificates expose private keys to users, increasing risk of key theft.

💡 Hint

Think about who is responsible for tracking certificate expiration.

Self-managed certificates require manual renewal. If forgotten, they expire causing warnings and downtime. Google-managed certificates handle renewal automatically.

✅ Best Practice

expert

Optimal strategy for managing SSL certificates across multiple GCP projects

You manage multiple Google Cloud projects for different teams, each with their own domains. What is the best practice for managing SSL certificates efficiently and securely across these projects?

A Centralize SSL certificate management in one project using Google-managed certificates and share them via Cloud Load Balancer across projects.

B Each project manages its own self-managed certificates independently to avoid cross-project dependencies.

C Use a single self-managed wildcard certificate uploaded to all projects to simplify management.

D Store all certificates in a shared Cloud Storage bucket accessible by all projects for manual deployment.

💡 Hint

Consider security, automation, and ease of management across projects.

Centralizing certificate management with Google-managed certificates reduces manual work, improves security, and allows sharing via load balancers, making option A best practice.