GCP Professional Cloud Security Engineer Practice Question

Your banking platform is expanding to four Google Cloud projects, each hosting GKE clusters that communicate over a service mesh. Compliance mandates mutual TLS for all service-to-service traffic with certificates issued from an internal private PKI whose root must remain offline. Certificates must have a 24-hour lifetime and be rotated automatically. Operations insists on a managed service that offers an SLA for certificate issuance and supports API-driven automation as well as seamless CA key rotation. Which approach best meets these requirements?

Use Google Cloud Public Certificate Authority to issue publicly trusted certificates and push them to workloads using Workload Identity.
Configure Google-managed SSL certificates on an external HTTP(S) load balancer and distribute the certificates to the clusters via Secret Manager for mutual TLS.
Provision a Certificate Authority Service Enterprise-tier CA pool with an offline root CA and subordinate issuing CAs, and automate 24-hour certificate issuance for the service mesh through CAS APIs.
Operate a self-hosted OpenSSL root CA on a Compute Engine VM, sign service CSRs in the CI/CD pipeline, and rotate keys manually on an annual schedule.

Report Issue

Answer Description

Google Cloud Certificate Authority Service (CAS) can be deployed in an Enterprise-tier CA pool, which provides a 99.9 % availability SLA for CreateCertificate operations and managed redundancy. You can maintain an offline root CA for security while using one or more online subordinate CAs in the pool to issue end-entity certificates. CAS exposes REST and gcloud APIs, enabling automated 24-hour certificate issuance and rotation for the service mesh. Google-managed SSL certificates and Google Public CA issue publicly trusted certificates for external endpoints and do not support offline private roots or very short-lived programmatic issuance. A self-managed OpenSSL CA on a VM lacks managed availability guarantees and requires significant operational effort for scaling and rotation. Therefore, using CAS Enterprise tier with an offline root and subordinate issuing CAs is the only option that satisfies all compliance, automation, and availability requirements.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.