mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A team deploys an application on GKE and needs it…
A team deploys an application on GKE and needs it to be accessible at https://api.company.com with automatic TLS certificate provisioning. They use a Global external Application Load Balancer. What handles the TLS certificate?
⚠ Common exam trap
Test-takers frequently confuse the Kubernetes Ingress resource (which can use cert-manager) with the Global external Application Load Balancer's HTTPS target proxy, which requires a Google-managed SSL certificate attached directly to the proxy, not a Kubernetes-native certificate solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Google-managed SSL certificate attached to the load balancer's HTTPS target proxy
A Global external Application Load Balancer uses an HTTPS target proxy to terminate TLS. To automatically provision and renew TLS certificates for a custom domain, you attach a Google-managed SSL certificate to that target proxy. Google manages the entire lifecycle, including domain verification via Cloud DNS, so no manual certificate generation or third-party tools are needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The GKE cluster automatically generates a self-signed TLS certificate for the domain
Why it's wrong here
GKE clusters never automatically issue TLS certificates for custom domains; the control plane's self-signed certificates are reserved for internal cluster communication, not public HTTPS termination. To use a self-signed cert for the Ingress, you'd have to manually create it as a Kubernetes secret and configure the load balancer, which would still trigger browser trust warnings because no public CA validates it.
- ✓
A Google-managed SSL certificate attached to the load balancer's HTTPS target proxy
Why this is correct
A Google-managed SSL certificate is issued by Google's own CA, automatically renewed before expiry, and attached directly to the target HTTPS proxy of the external HTTP(S) load balancer. Domain ownership is verified via a DNS record, and once the certificate is active, you manage zero certificate lifecycle tasks. This is the native, fully managed GCP path for exposing a service securely over HTTPS.
- ✗
Cloud DNS automatically provisions a TLS certificate when a domain is added
Why it's wrong here
Cloud DNS is purely a DNS hosting service that maps hostnames to IP addresses—it has no capability or role in TLS certificate issuance. Adding a domain to Cloud DNS merely creates record sets; certificates are provisioned and stored at the load balancer layer, and DNS may only be used as a verification mechanism for Google-managed certificates. There is no automatic TLS provisioning as part of DNS zone management.
- ✗
cert-manager in GKE automatically obtains Let's Encrypt certificates for the Ingress
Why it's wrong here
cert-manager is a valid open-source tool that can obtain certificates from Let's Encrypt and integrate with Ingress through annotations, but it is not a built-in GKE feature and requires manual installation, configuration, and periodic maintenance in the cluster. It does not automatically discover Ingress resources unless explicitly set up with issuers and annotations. Google-managed certificates offer the same outcome without any cluster-side components, making cert-manager the more complex alternative.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
Key term
Cloud DNS
A managed domain name system service that translates human-readable domain names into IP addresses, enabling reliable and scalable network routing in cloud environments.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.