Certificate Authority Service in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a new Certificate Authority in Google Cloud.

GCP

gcloud privateca certificate-authorities create my-ca --location=[1] --pool=my-pool

Drag options to blanks, or click blank then click option'

Asouthamerica-east1

Beurope-west1

Casia-east1

Dus-central1

Attempts:

3 left

💡 Hint

Common Mistakes

Using a region where the service is not available.

Leaving the location blank.

The us-central1 region is commonly used for creating Certificate Authorities in Google Cloud. This command sets the location for the CA.

2fill in blank

medium

Complete the code to issue a new certificate from an existing Certificate Authority.

GCP

gcloud privateca certificates create my-cert --certificate-authority=my-ca --location=us-central1 --certificate-config=[1]

Drag options to blanks, or click blank then click option'

Aconfig.yaml

Bconfig.json

Cconfig.txt

Dconfig.xml

Attempts:

3 left

💡 Hint

Common Mistakes

Using a YAML or XML file instead of JSON.

Using a text file without proper JSON structure.

The certificate configuration is typically provided in a JSON file. Here, config.json is the correct format for the certificate config.

3fill in blank

hard

Fix the error in the command to revoke a certificate by completing the missing flag.

GCP

gcloud privateca certificates revoke my-cert --certificate-authority=my-ca --location=us-central1 [1]=KEY_COMPROMISE

Drag options to blanks, or click blank then click option'

A--reason

B--cause

C--status

D--type

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect flags like --cause or --type.

Omitting the reason flag entirely.

The --reason flag specifies why the certificate is revoked. KEY_COMPROMISE is a valid reason.

4fill in blank

hard

Fill both blanks to create a certificate revocation list (CRL) and specify its maximum size.

GCP

gcloud privateca crl-pools create my-crl-pool --location=us-central1 --max-entries=[1] --description=[2]

Drag options to blanks, or click blank then click option'

A1000

B500

C"CRL for revoked certificates"

D"Certificate revocation list"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a small number for max entries.

Not quoting the description string.

The --max-entries flag sets the maximum number of entries in the CRL. 1000 is a common limit. The --description flag provides a description, here "CRL for revoked certificates".

5fill in blank

hard

Fill all three blanks to define a certificate template with a specific key algorithm, key usage, and lifetime.

GCP

gcloud privateca templates create my-template --location=us-central1 --key-algorithm=[1] --key-usage=[2] --lifetime=[3]

Drag options to blanks, or click blank then click option'

ARSA_2048

Bdigital_signature

C8760h

DECDSA_P256

Attempts:

3 left

💡 Hint

Common Mistakes

Using RSA instead of ECDSA for key algorithm.

Using incorrect key usage values.

Setting lifetime in wrong units.

The --key-algorithm is set to ECDSA_P256 for a secure elliptic curve key. The --key-usage is digital_signature to allow signing. The --lifetime is 8760h, which equals one year.