Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Your enterprise platform team is preparing to migrate several multi-tenant custom domains (including wildcard domains) to a global External Application Load Balancer. You are designing an automated CI/CD deployment pipeline using Google Cloud Certificate Manager to manage public SSL/TLS certificates.
You have the following operational requirements:
Which workflow should you implement in your automated deployment pipeline to satisfy these requirements?
Create Load Balancer-managed certificates referencing HTTP authorizations, deploy a URL map path-matcher rule forwarding /.well-known/acme-challenge/ to a backend bucket, attach the certificates directly to the target HTTPS proxy, and shift DNS A records to trigger validation.
Generate self-signed fallback certificates, attach them to the Target SSL Proxy, and configure a Cloud Run job in the CI/CD pipeline to query Let's Encrypt ACME APIs to upload and rotate renewed certificates via Secret Manager.
Create a global Certificate Map with fallback wildcards, attach the map to the forwarding rule, and configure Cloud DNS peering to automatically issue Google-managed certificates without external DNS records.
Create Certificate Manager DNS authorizations, publish the generated CNAME challenge records to the authoritative DNS provider, provision Google-managed certificates referencing these DNS authorizations, map the certificates to domain entries within a Certificate Map, and attach the Certificate Map to the target HTTPS proxy.
Google Cloud Certificate Manager is a dedicated service designed to centrally manage, provision, and bind public and private SSL/TLS certificates to Google Cloud load balancers. It replaces traditional target proxy certificate lists by introducing Certificate Maps and DNS Authorizations, enabling automated zero-downtime certificate lifecycle management and scaling to hundreds of thousands of domain certificates.
StudyCerts
StudyCertsACTIVE state before modifying customer-facing DNS records.*.example.com) and allows provisioning certificates for domains currently serving live traffic on third-party infrastructure without requiring downtime or temporary HTTP routing.This sequence guarantees that certificates are valid and active prior to DNS cutover, fully supports wildcard domain validation, and leverages modern Certificate Maps attached to the Target HTTPS Proxy for automated renewals and maximum scalability.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.