PCNE Configuring Network Services Practice Question
You are configuring an SSL Proxy load balancer for HTTPS traffic. The backend service points to an instance group with a self-managed certificate. The load balancer's frontend uses a Google-managed certificate. Clients receive SSL errors indicating certificate mismatch. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the distinction between frontend and backend certificate validation, and candidates mistakenly think a backend certificate issue (like not being signed by a public CA) would cause frontend client errors, when in fact the frontend certificate mismatch is caused by domain verification failure for the Google-managed certificate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The domain is not verified for the Google-managed certificate on the frontend.
When a Google-managed certificate is used on the frontend of an SSL proxy load balancer, the domain must be verified via DNS or a challenge file. If the domain is not verified, the certificate cannot be provisioned or validated, causing a mismatch between the certificate's Subject Alternative Names (SANs) and the domain clients are connecting to, resulting in SSL errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSL policy is configured to require TLS 1.3 only.
Why it's wrong here
TLS version mismatch would cause handshake failure, not certificate mismatch.
- ✓
The domain is not verified for the Google-managed certificate on the frontend.
Why this is correct
Google-managed certificates require domain verification; if not verified, the certificate may not issue, causing mismatch.
- ✗
The backend self-managed certificate is not signed by a public CA.
Why it's wrong here
SSL Proxy does not validate backend certificate by default.
- ✗
The backend service must use a Google-managed certificate as well.
Why it's wrong here
Backend can use self-managed certificates.
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.