Google Professional Cloud Developer Question 7
Select 2Google Cloud PlatformYou are designing a microservices-based application on Google Cloud. One of your services requires secure communication with other services and needs to handle service discovery dynamically. Which combination of solutions would best meet these requirements?
- A
Use Google Kubernetes Engine (GKE) with Istio service mesh for secure communication and service discovery.
- B
Implement a custom service discovery mechanism using a relational database to store service endpoints.
- C
Use GCP's Cloud Endpoints for secure communication and Pub/Sub for service discovery.
- D
Use GKE with built-in DNS for service discovery and configure TLS certificates for secure communication.
- E
Leverage Cloud Run for service deployment and configure IAM policies for secure communication.
Show answer and explanation
Correct answers: A, D
Explanation
In a microservices architecture, secure communication and dynamic service discovery are critical. GKE with Istio service mesh is a robust solution offering mTLS for secure communication and efficient service discovery. Alternatively, GKE's built-in DNS can handle service discovery, and TLS certificates can be manually configured for secure communication. Other options either lack the required functionality or are not scalable compared to managed solutions.
- A. Correct.
Using GKE with Istio service mesh provides built-in secure communication via mTLS (mutual TLS) and dynamic service discovery through Istio's service registry. This is a modern and scalable approach to meet the requirements.
- B. Incorrect.
Implementing a custom service discovery mechanism using a relational database is not recommended due to its lack of scalability and complexity compared to managed solutions like Istio.
- C. Incorrect.
Cloud Endpoints is primarily used for API management and does not provide dynamic service discovery. Pub/Sub is a messaging service and is not suitable for service discovery.
- D. Correct.
GKE with built-in DNS provides service discovery using Kubernetes DNS, and TLS certificates can be configured for secure communication. This is a valid approach when Istio is not in use.
- E. Incorrect.
While Cloud Run supports secure communication through IAM policies, it does not natively handle dynamic service discovery in the same way as GKE with Istio or Kubernetes DNS.