Google Professional Cloud Developer Question 141
Select 3Google Cloud PlatformYou are developing a backend service on Google Cloud that communicates with another internal microservice over HTTPS. To ensure secure communication and mutual authentication between the services, you decide to implement certificate-based authentication using mTLS. Which of the following steps are necessary to properly configure mTLS in this setup?
- A
Generate a pair of client and server certificates signed by the same trusted Certificate Authority (CA).
- B
Enable HTTP Basic Authentication on both microservices to complement mTLS.
- C
Configure the backend service to present its client certificate during the TLS handshake.
- D
Set up a load balancer that terminates mTLS and forwards traffic as plain HTTP to the backend service.
- E
Validate the client certificate at the server-side microservice to ensure it is signed by the trusted CA.
Show answer and explanation
Correct answers: A, C, E
Explanation
mTLS (Mutual TLS) ensures both the client and server authenticate each other using certificates and establishes a secure connection. To configure mTLS, you need a pair of certificates signed by the same trusted CA, the client must present its certificate during the TLS handshake, and the server must validate the certificate. HTTP Basic Authentication is unnecessary, and terminating mTLS at a load balancer would compromise the security benefits of mTLS.
- A. Correct.
Correct: For mTLS to work, both the client and server certificates must be signed by the same trusted CA to establish mutual trust.
- B. Incorrect.
Incorrect: HTTP Basic Authentication is not required for mTLS. mTLS already ensures secure authentication and encryption.
- C. Correct.
Correct: The client certificate is required during the TLS handshake to authenticate the client to the server.
- D. Incorrect.
Incorrect: Terminating mTLS at a load balancer and forwarding plain HTTP traffic defeats the purpose of mTLS, which ensures end-to-end encryption and mutual authentication.
- E. Correct.
Correct: The server must validate the client's certificate to ensure it is signed by the trusted CA to establish trust.