Google Professional Cloud Developer Question 139
Select 3Google Cloud PlatformYou are developing a microservices-based application on Google Cloud that requires secure communication between services. To ensure mutual trust and encrypted communication, you decide to implement certificate-based authentication using mTLS. Which steps should you take to configure mTLS correctly for your services running on Google Kubernetes Engine (GKE)?
- A
Generate and configure a root CA and server/client certificates for your services.
- B
Enable Traffic Director and configure its control plane to enforce mTLS.
- C
Deploy a sidecar proxy (e.g., Envoy or Istio) to handle mTLS communication for each service.
- D
Configure a firewall rule to only allow traffic from known IP addresses.
- E
Set up a Kubernetes Network Policy to enforce mTLS communication between specific services.
Show answer and explanation
Correct answers: A, B, C
Explanation
To implement mTLS on GKE, you need to generate root CA and certificates to establish trust, use Traffic Director to manage and enforce mTLS policies, and deploy sidecar proxies like Envoy or Istio to handle secure communication. Firewall rules and Kubernetes Network Policies, while useful for other security purposes, do not handle certificate-based authentication or mTLS.
- A. Correct.
Correct. mTLS requires a root Certificate Authority (CA) and server/client certificates for mutual authentication.
- B. Correct.
Correct. Traffic Director can be configured to enforce mTLS for service communications on GKE.
- C. Correct.
Correct. Sidecar proxies like Envoy or Istio handle mTLS authentication and encryption between services.
- D. Incorrect.
Incorrect. While configuring firewall rules can enhance security, it does not implement mTLS or certificate-based authentication.
- E. Incorrect.
Incorrect. Kubernetes Network Policies control traffic flow between pods but do not enforce mTLS or handle certificates.