Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your security team is rolling out mutual TLS between microservices that run on multiple GKE clusters in three regions. They expect to issue about 50 000 short-lived certificates every day and want to avoid hard-coding which subordinate CA signs each request. Production and staging certificates must be isolated while using the same automated process, and the GKE workload identity that requests the certificates must not be able to change CA configuration. Which architecture satisfies these requirements with the least operational overhead?

  • Add a self-signed root certificate to each cluster's trust store, generate certificates locally with kubectl cert-manager, and periodically upload the resulting CRLs to Certificate Authority Service.

  • Create two Enterprise-tier CA pools (prod and stage), each with several subordinate CAs. Attach an environment-specific certificate template to each pool and grant only the privateca.certificateRequester role on the pool to the GKE workload identity.

  • Create one shared DevOps-tier CA pool that contains a single subordinate CA, reference that CA name in every CSR, and grant the workload identity the privateca.admin role on the pool.

  • Deploy an unmanaged OpenSSL CA on a Compute Engine instance per environment, store the private keys in Cloud HSM, and allow the workload identity to SSH into the instance to run certmonger.

GCP Professional Cloud Security Engineer
Securing communications and establishing boundary protection
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot