Google Professional Cloud Developer Question 144
Select 3Google Cloud PlatformYou are developing a cloud-based API hosted on Google Cloud and want to secure client-server communication with mutual TLS (mTLS). Which of the following steps are necessary to implement certificate-based authentication using mTLS in your application?
- A
Generate a server certificate signed by a trusted Certificate Authority (CA).
- B
Configure the API backend to verify client certificates against a trusted CA.
- C
Use Google Cloud IAM to assign roles for validating certificates.
- D
Ensure the client application is configured to present its certificate during the TLS handshake.
- E
Deploy a load balancer configured to terminate SSL/TLS traffic without requiring client certificates.
Show answer and explanation
Correct answers: A, B, D
Explanation
Mutual TLS (mTLS) requires both the server and client to present certificates during the handshake. The server must have a certificate issued by a trusted CA to establish its identity, and the API backend must verify the client's certificate against a trusted CA. The client application must also be configured to present its certificate to complete the mTLS handshake. Google Cloud IAM is unrelated to mTLS certificate validation, and terminating SSL/TLS without requiring client certificates does not meet mTLS requirements.
- A. Correct.
Correct. A server certificate signed by a trusted CA is necessary to establish the server's identity in mTLS.
- B. Correct.
Correct. The API backend must verify client certificates against a trusted CA to authenticate the client in mTLS.
- C. Incorrect.
Incorrect. Google Cloud IAM is used for role-based access control, not for validating SSL/TLS certificates.
- D. Correct.
Correct. The client application must present its certificate during the TLS handshake for mTLS to work.
- E. Incorrect.
Incorrect. A load balancer terminating SSL/TLS without requiring client certificates does not fulfill the requirements for mTLS, which mandates mutual authentication.