Explanation:
The question requires issuing certificates for multiple HTTP load balancer frontends using an existing on-premises PKI, with key constraints being minimal impact on the manual on-premises processes and scalability. Option B is optimal because it uses Google Certificate Authority Service (CAS) as a subordinate CA to the on-premises PKI, enabling automated certificate issuance for load balancers without frequent manual intervention from the on-premises team. This scales well as the number of load balancers increases. Option C (importing certificates via Certificate Manager and gcloud) is less suitable because it still requires manual certificate issuance from the on-premises PKI for each load balancer, which does not minimize impact or scale effectively. Option A (Google-managed certificates) bypasses the on-premises PKI entirely, violating the requirement to use it. Option D uses inappropriate tools (OpenSSL, TCP/UDP load balancer instead of HTTP) and manual processes, failing to meet scalability and minimal impact goals. The community discussion strongly supports B (83% consensus, highest upvotes) due to its automation and scalability advantages.
Ultimate access to all questions.
No comments yet.
You need to issue certificates for multiple HTTP load balancer frontends using an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). The solution must scale effectively while minimizing the operational impact on the on-premises PKI, which involves many manual processes.
What is the recommended approach?
A
Use Certificate Manager to issue Google managed public certificates and configure it at HTTP the load balancers in your infrastructure as code (IaC).
B
Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
C
Use Certificate Manager to import certificates issued from on-premises PKI and for the frontends. Leverage the gcloud tool for importing.
D
Use the web applications with PKCS12 certificates issued from subordinate CA based on OpenSSL on-premises. Use the gcloud tool for importing. Use the External TCP/UDP Network load balancer instead of an external HTTP Load Balancer.