Google ACE Configuring Access and Security Practice Question
You need to create a Google-managed SSL certificate for an external HTTPS load balancer. The domain is 'www.example.com'. Which command creates the certificate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gcloud compute ssl-certificates create my-cert --domains www.example.com
The correct command is gcloud compute ssl-certificates create with the --domains flag. This creates a Google-managed certificate that will be provisioned and renewed automatically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
gcloud compute ssl-certificates create my-cert --certificate example.crt --private-key example.key
Why it's wrong here
Supplying both --certificate and --private-key creates a self-managed SSL certificate resource: you are providing the PEM certificate and its private key, so Google stores these for use by load balancers but does not handle renewal. This violates the requirement to create a Google-managed certificate, which is instead triggered by specifying --domains. The lifecycle remains your responsibility, and the certificate will not be automatically renewed when it approaches expiry.
- ✗
gcloud compute ssl-certificates create my-cert --certificate example.crt
Why it's wrong here
The command omits the --private-key flag, making it invalid for a self-managed certificate because a usable SSL certificate resource requires both the certificate chain and its matching private key. Even if gcloud accepted the invocation, there is no --domains flag, so it cannot be interpreted as a request for a Google-managed certificate either. The result would be a CLI error or an unusable resource that cannot be attached to a target HTTPS proxy.
- ✓
gcloud compute ssl-certificates create my-cert --domains www.example.com
Why this is correct
The --domains flag is the correct mechanism to request a Google-managed certificate: gcloud will create an SslCertificate resource in MANAGED state, and Google's Certificate Authority will issue a certificate for the specified domain, handling the entire lifecycle including automatic renewal. No additional flags are required, because the presence of --domains unambiguously selects the managed provisioning mode. This command is the exact answer for creating a managed certificate via the gcloud CLI.
- ✗
gcloud compute ssl-certificates create my-cert --domains www.example.com --managed
Why it's wrong here
The --managed flag does not exist in the gcloud compute ssl-certificates create command, so this invocation fails immediately with an 'unknown flag' error before any API call is made. The managed or self-managed selection is determined implicitly rather than explicitly: --domains signals a Google-managed certificate, while --certificate/--private-key signals a self-managed one. Adding an explicit --managed flag reflects a common misconception about how the CLI infers the certificate type.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.