Answer-first summary for fast verification
Answer: Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
The question requires issuing certificates for multiple HTTP load balancer frontends using an existing on-premises PKI, with key constraints being minimal impact on the manual on-premises processes and scalability. Option B is optimal because it uses Google Certificate Authority Service (CAS) as a subordinate CA to the on-premises PKI, enabling automated certificate issuance for load balancers without frequent manual intervention from the on-premises team. This scales well as the number of load balancers increases. Option C (importing certificates via Certificate Manager and gcloud) is less suitable because it still requires manual certificate issuance from the on-premises PKI for each load balancer, which does not minimize impact or scale effectively. Option A (Google-managed certificates) bypasses the on-premises PKI entirely, violating the requirement to use it. Option D uses inappropriate tools (OpenSSL, TCP/UDP load balancer instead of HTTP) and manual processes, failing to meet scalability and minimal impact goals. The community discussion strongly supports B (83% consensus, highest upvotes) due to its automation and scalability advantages.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
You need to issue certificates for multiple HTTP load balancer frontends using an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). The solution must scale effectively while minimizing the operational impact on the on-premises PKI, which involves many manual processes.
What is the recommended approach?
A
Use Certificate Manager to issue Google managed public certificates and configure it at HTTP the load balancers in your infrastructure as code (IaC).
B
Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
C
Use Certificate Manager to import certificates issued from on-premises PKI and for the frontends. Leverage the gcloud tool for importing.
D
Use the web applications with PKCS12 certificates issued from subordinate CA based on OpenSSL on-premises. Use the gcloud tool for importing. Use the External TCP/UDP Network load balancer instead of an external HTTP Load Balancer.