Google Professional Cloud Developer Question 140
Select 3Google Cloud PlatformYou are developing a secure API running on Google Kubernetes Engine (GKE) that will be consumed by external clients. The API requires certificate-based authentication using mTLS to ensure both the client and server are verified during communication. Which of the following steps must you implement to properly configure mTLS?
- A
Generate client and server certificates signed by a trusted Certificate Authority (CA).
- B
Configure a Kubernetes Ingress with SSL termination and upload only the server's private key.
- C
Enable Mutual TLS on the Ingress or Load Balancer and provide both client and server certificates.
- D
Distribute the server's private key to all external clients for establishing trust.
- E
Store and manage certificates securely using Google Cloud's Certificate Manager.
Show answer and explanation
Correct answers: A, C, E
Explanation
To properly configure mTLS for your API, you must generate client and server certificates signed by a trusted CA, enable Mutual TLS on the Ingress or Load Balancer to enforce two-way authentication, and securely manage your certificates using tools like Google Cloud's Certificate Manager. This ensures secure communication and mutual authentication without compromising sensitive credentials like private keys.
- A. Correct.
Correct. mTLS requires both client and server certificates signed by a trusted CA to establish a mutual trust relationship.
- B. Incorrect.
Incorrect. While SSL termination is part of securing communication, mTLS specifically requires verification of both client and server certificates, not just the server's private key.
- C. Correct.
Correct. Mutual TLS must be explicitly enabled on the Ingress or Load Balancer to enforce two-way authentication.
- D. Incorrect.
Incorrect. Distributing the server's private key violates security best practices and compromises the security of your application.
- E. Correct.
Correct. Google Cloud's Certificate Manager is a secure and recommended way to store and manage certificates for mTLS and other use cases.