Google Professional Cloud Developer Question 142
Select 3Google Cloud PlatformYou are designing a secure API that must only allow trusted client applications to access it. The API is hosted on Google Kubernetes Engine (GKE) and exposed via an HTTPS Load Balancer. To ensure secure communication and verify client identity, you decide to implement mutual TLS (mTLS). Which of the following steps are necessary to configure mTLS for this setup?
- A
Configure a client certificate and private key for the trusted clients.
- B
Enable the mTLS option in the HTTPS Load Balancer configuration.
- C
Create a server-side SSL certificate and upload it to the HTTPS Load Balancer.
- D
Configure a firewall rule to allow traffic only from trusted IP addresses.
- E
Set up a Certificate Authority (CA) to issue client and server certificates.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement mTLS, both the client and server must present trusted certificates to authenticate each other. This requires configuring client certificates, server-side certificates, and a trusted Certificate Authority (CA) for issuing these certificates. While the HTTPS Load Balancer can handle basic TLS, implementing mTLS typically requires additional configurations on the backend, such as using a service mesh like Istio. Firewall rules, though useful for additional security, are not a mandatory part of the mTLS configuration.
- A. Correct.
Correct. mTLS requires the client to have a certificate and private key to authenticate itself to the server.
- B. Incorrect.
Incorrect. While the HTTPS Load Balancer supports server-side TLS, it does not directly support mTLS. mTLS needs to be implemented at the backend, such as in GKE using Istio or another service mesh.
- C. Correct.
Correct. The server-side SSL certificate is required for establishing the initial secure connection.
- D. Incorrect.
Incorrect. While firewall rules can restrict traffic based on IP addresses, they are not related to configuring mTLS.
- E. Correct.
Correct. A Certificate Authority (CA) is required to issue the trusted certificates for both the client and server in an mTLS setup.