Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  gcloud compute target-https-proxies create --ssl-certificates

  Why it's wrong here

  The `gcloud compute target-https-proxies create` command provisions a load-balancing component that terminates HTTPS connections, but its `--ssl-certificates` parameter only references existing SSL certificate resources you have already created. It does not create, validate, or manage certificates, and it certainly cannot generate a Google-managed certificate. Without a pre-existing certificate resource, the proxy creation will fail, so this command cannot satisfy the requirement to create a Google-managed SSL certificate.

• ✓

  gcloud compute ssl-certificates create --domains example.com

  Why this is correct

  The `gcloud compute ssl-certificates create` command with the `--domains` flag provisions a Google-managed SSL certificate, which satisfies the stem’s requirement for a Google-managed certificate rather than a self-managed one. This command triggers Google’s Certificate Authority to automatically handle domain validation and renewal for `example.com`, eliminating the need for manual certificate uploads. It directly attaches to the HTTPS load balancer’s target proxy, meeting the load-balancer constraint.

• ✗

  gcloud compute ssl-policies create

  Why it's wrong here

  The `gcloud compute ssl-policies create` command is used to define security settings like the minimum TLS version and allowed cipher suites, which are then attached to a target HTTPS proxy. It does not provision any certificate data; policies only govern how certificates that are already attached are negotiated. Therefore, it is inherently about TLS policy configuration, not certificate creation, making it ineligible for the task.

• ✗

  gcloud compute ssl-certificates create --certificate example.crt --private-key example.key

  Why it's wrong here

  The `gcloud compute ssl-certificates create --certificate example.crt --private-key example.key` command uploads your own certificate chain and private key to create a self-managed SSL certificate resource. Because you supply the key material, Google does not control or automatically renew it, so it is not Google-managed. To get a Google-managed certificate, you must use the `--domains` flag without specifying a certificate or private key, allowing Google to generate and manage the certificate and its renewal.

Go deeper

Related to this question