SSL certificates management in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Google Cloud Load Balancer handle SSL certificates?

When you attach an SSL certificate to a Google Cloud HTTPS Load Balancer, what happens when the certificate expires?

A The load balancer continues serving HTTPS traffic but browsers show a security warning.

B The load balancer automatically renews the certificate without user intervention.

C The load balancer switches to HTTP traffic automatically to avoid errors.

D The load balancer stops serving HTTPS traffic until a new certificate is uploaded.

💡 Hint

Think about what happens when a browser checks a certificate that is no longer valid.

When an SSL certificate expires, the load balancer still serves HTTPS traffic, but browsers detect the expired certificate and warn users. The load balancer does not automatically renew certificates or switch protocols.

❓ Configuration

intermediate

Correct JSON format for uploading a managed SSL certificate in GCP

You want to create a managed SSL certificate resource in Google Cloud using JSON. Which JSON snippet correctly defines the domains for the certificate?

A { "name": "my-cert", "managed": { "domains": "example.com, www.example.com" } }

B { "name": "my-cert", "managed": { "domains": ["example.com www.example.com"] } }

C { "name": "my-cert", "managed": { "domain": "example.com,www.example.com" } }

D { "name": "my-cert", "managed": { "domains": ["example.com", "www.example.com"] } }

💡 Hint

Remember that domains should be a list of strings, not a single string.

The correct format uses a JSON array for the domains field. Options A, B, and D use incorrect types or formats for the domains.

❓ Architecture

advanced

Best architecture for automatic SSL certificate renewal in GCP

You want to design a system that automatically provisions and renews SSL certificates for multiple domains on Google Cloud. Which architecture best supports this?

A Use Cloud DNS with manual certificate uploads to App Engine, renewing certificates via scripts.

B Use Google-managed SSL certificates attached to a Cloud Load Balancer for each domain, letting Google handle renewals.

C Manually upload self-managed certificates to Compute Engine instances and renew them using cron jobs.

D Use third-party certificate providers and manually update certificates in Cloud Storage buckets.

💡 Hint

Consider which option minimizes manual work and leverages Google Cloud's automation.

Google-managed SSL certificates automatically renew and integrate with Cloud Load Balancers, making option B the best architecture for automatic renewal.

❓ security

advanced

Security risk of using self-managed SSL certificates on Google Cloud

What is a key security risk when using self-managed SSL certificates on Google Cloud compared to Google-managed certificates?

A Self-managed certificates automatically renew, which can lead to unauthorized renewals.

B Self-managed certificates cannot be used with HTTPS Load Balancers, reducing security.

C Self-managed certificates may expire unnoticed, causing service interruptions and security warnings.

D Google-managed certificates expose private keys to users, increasing risk of key theft.

💡 Hint

Think about who is responsible for tracking certificate expiration.

Self-managed certificates require manual renewal. If forgotten, they expire causing warnings and downtime. Google-managed certificates handle renewal automatically.

✅ Best Practice

expert

Optimal strategy for managing SSL certificates across multiple GCP projects

You manage multiple Google Cloud projects for different teams, each with their own domains. What is the best practice for managing SSL certificates efficiently and securely across these projects?

A Centralize SSL certificate management in one project using Google-managed certificates and share them via Cloud Load Balancer across projects.

B Each project manages its own self-managed certificates independently to avoid cross-project dependencies.

C Use a single self-managed wildcard certificate uploaded to all projects to simplify management.

D Store all certificates in a shared Cloud Storage bucket accessible by all projects for manual deployment.

💡 Hint

Consider security, automation, and ease of management across projects.

Centralizing certificate management with Google-managed certificates reduces manual work, improves security, and allows sharing via load balancers, making option A best practice.

Practice

1. What is the main purpose of an SSL certificate in Google Cloud Platform?

easy

A. To encrypt data between users and servers

B. To store user passwords securely

C. To monitor network traffic

D. To manage virtual machines

Solution

1. Step 1: Understand SSL certificate function

   SSL certificates encrypt data to keep communication secure.

2. Step 2: Identify correct purpose in GCP context

   Encrypting data between users and servers matches SSL certificate use.

3. Final Answer:

   To encrypt data between users and servers -> Option A

4. Quick Check:

   SSL certificates = encrypt data [OK]

Hint: SSL certificates secure data transfer by encryption [OK]

Common Mistakes:

• Confusing SSL with password storage
• Thinking SSL monitors traffic
• Assuming SSL manages VMs

2. Which gcloud command correctly creates a new SSL certificate in GCP?

easy

A. gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem

B. gcloud ssl create certificate my-cert --cert=cert.pem --key=key.pem

C. gcloud compute certificates add my-cert --cert=cert.pem --key=key.pem

D. gcloud create ssl my-cert --certificate=cert.pem --private-key=key.pem

Solution

1. Step 1: Recall correct gcloud syntax for SSL certificate creation

   The correct command uses 'gcloud compute ssl-certificates create' with certificate and private key flags.

2. Step 2: Match options to correct syntax

   gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem matches the correct syntax exactly; others use invalid commands or flags.

3. Final Answer:

   gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem -> Option A

4. Quick Check:

   Correct gcloud SSL create command = gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem [OK]

Hint: Use 'gcloud compute ssl-certificates create' with cert and key [OK]

Common Mistakes:

• Using wrong gcloud subcommands
• Mixing up flag names
• Omitting private key parameter

3. Given this command output listing SSL certificates in GCP:

NAME       CREATION_TIMESTAMP
my-cert    2023-05-01T12:00:00.000Z
old-cert   2022-01-15T08:30:00.000Z

Which certificate is most likely expired or needs renewal?

medium

A. Cannot determine from timestamps

B. my-cert

C. Both are valid

D. old-cert

Solution

1. Step 1: Analyze creation timestamps

   my-cert was created in May 2023; old-cert in January 2022.

2. Step 2: Consider typical SSL certificate validity

   SSL certificates usually last 1 year; old-cert is over a year old and likely expired.

3. Final Answer:

   old-cert -> Option D

4. Quick Check:

   Older certificate likely expired = old-cert [OK]

Hint: Older creation date usually means expired certificate [OK]

Common Mistakes:

• Assuming all certificates are valid
• Ignoring certificate age
• Thinking creation time equals expiration

4. You run this command to create an SSL certificate:

gcloud compute ssl-certificates create my-cert --certificate=cert.pem --private-key=key.pem

But get an error: "ERROR: (gcloud.compute.ssl-certificates.create) The private key file is invalid or missing." What is the most likely cause?

medium

A. The gcloud SDK is not installed

B. The certificate file is not in PEM format

C. The private key file path is incorrect or file is missing

D. The command requires a project flag

Solution

1. Step 1: Understand error message

   The error says the private key file is invalid or missing, indicating a problem with the key file.

2. Step 2: Identify common causes

   Incorrect file path or missing file for the private key is the most common cause.

3. Final Answer:

   The private key file path is incorrect or file is missing -> Option C

4. Quick Check:

   Private key file error = wrong path or missing file [OK]

Hint: Check private key file path and existence first [OK]

Common Mistakes:

• Blaming certificate format instead of key file
• Assuming gcloud SDK missing causes this error
• Forgetting to specify project flag

5. You want to automate SSL certificate renewal in GCP for a load balancer. Which approach best ensures certificates are renewed before expiration without downtime?

hard

A. Delete the old certificate and create a new one with the same name immediately

B. Create a new SSL certificate, update the load balancer to use it, then delete the old certificate

C. Manually update the certificate on the load balancer after expiration

D. Use the same certificate indefinitely without renewal

Solution

1. Step 1: Understand zero downtime renewal process

   Creating a new certificate and updating the load balancer before deleting old one avoids downtime.

2. Step 2: Evaluate options for automation and safety

   Create a new SSL certificate, update the load balancer to use it, then delete the old certificate follows best practice: create new cert, switch, then delete old cert.

3. Final Answer:

   Create a new SSL certificate, update the load balancer to use it, then delete the old certificate -> Option B

4. Quick Check:

   Renew by create-update-delete sequence = Create a new SSL certificate, update the load balancer to use it, then delete the old certificate [OK]

Hint: Renew by adding new cert, switch LB, then remove old cert [OK]

Common Mistakes:

• Deleting old cert before new one is ready
• Waiting until expiration to update
• Ignoring renewal and using expired cert