Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  gcloud compute ssl-policies create my-policy --profile MODERN

  Why it's wrong here

  This command creates an SSL policy, not a certificate. An SSL policy defines the acceptable TLS protocol versions and cipher suites for a load balancer and is associated with Target HTTPS or SSL proxies. The --profile MODERN flag restricts connections to TLS 1.2 and above, but the policy resource contains no certificate material, so it cannot serve as a Google-managed SSL certificate.

• ✓

  gcloud compute ssl-certificates create my-cert --domains example.com

  Why this is correct

  This is the correct command because it explicitly instructs Compute Engine to provision a Google-managed certificate for the specified domains. The --domains flag triggers Google's automatic certificate management lifecycle: Google Cloud obtains the certificate and handles renewals approximately 30 days before expiration, though you must verify domain ownership first. After creation, the certificate resource still needs to be attached to a target HTTPS proxy and associated with a forwarding rule before it can serve traffic.

• ✗

  gcloud compute ssl-certificates create my-cert --certificate cert.pem --private-key key.pem

  Why it's wrong here

  This command imports your own TLS certificate chain and private key into Compute Engine, creating a self-managed certificate resource. With a self-managed certificate, you are responsible for monitoring expiration and uploading a replacement before it expires, because Google Cloud will not renew it. The presence of --certificate and --private-key flags distinguishes this approach from a Google-managed certificate, which only requires --domains and does not use local key material.

• ✗

  gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert

  Why it's wrong here

  This command creates a target HTTPS proxy, which is the component that terminates incoming TLS traffic and forwards it to an associated URL map and backend service. The --ssl-certificates flag references an already-existing certificate resource that the proxy presents to clients, but it does not generate or manage any certificate itself. If the referenced certificate does not exist in the project, the command will fail, so this cannot be used to create a new Google-managed SSL certificate.

Go deeper

Related to this question