Quick Answer
The answer is an Ingress with a Google-managed SSL certificate. This resource is correct because it exposes a GKE application via a single stable IP address through a global forwarding rule, while the Google-managed SSL certificate terminates HTTPS traffic at the Cloud HTTP(S) load balancer, offloading SSL decryption from your pods and automatically renewing the certificate. On the Google Professional Cloud Developer exam, this scenario tests your understanding of how to combine stable external exposure with managed security—a common trap is choosing a Service of type LoadBalancer, which provides an ephemeral IP and requires manual certificate management. Remember that an Ingress acts as the smart front door: it gives you one stable IP for multiple services and handles SSL at the edge, not inside the cluster. Memory tip: “Ingress is the gatekeeper with a global IP and auto-renewing keys.”
This PCD practice question tests your understanding of deploying applications. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A team deploys a containerized web application on Google Kubernetes Engine (GKE) using a Deployment. They need to expose the application externally via a stable IP address and enable SSL termination. Which resource should they use?
HorizontalPodAutoscaler
Why wrong: Scales pods, does not expose services.
Ingress with Google-managed SSL certificate
Provides SSL termination and a stable IP via the load balancer.
Service type NodePort
Why wrong: Exposes on each node's port, not suitable for external SSL termination.
Service type LoadBalancer
Why wrong: Provides external IP but does not terminate SSL.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Ingress with Google-managed SSL certificate
An Ingress with a Google-managed SSL certificate is the correct choice because it provides a single stable IP address via a global forwarding rule, terminates SSL at the Google Cloud HTTP(S) load balancer, and routes traffic to the GKE Deployment. This approach offloads SSL decryption from the application pods and uses a managed certificate that auto-renews, meeting both the stable IP and SSL termination requirements.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
HorizontalPodAutoscaler
Why it's wrong here
Scales pods, does not expose services.
Ingress with Google-managed SSL certificate
Why this is correct
Provides SSL termination and a stable IP via the load balancer.
Related concept
Read the scenario before looking for a memorised answer.
Service type NodePort
Why it's wrong here
Exposes on each node's port, not suitable for external SSL termination.
Service type LoadBalancer
Why it's wrong here
Provides external IP but does not terminate SSL.
Common exam traps
Cisco often tests the misconception that a Service type LoadBalancer provides SSL termination, but it only provides L4 load balancing with a stable IP; SSL termination requires an L7 Ingress or a dedicated SSL proxy.
Detailed technical explanation
Under the hood, a GKE Ingress creates a Google Cloud HTTP(S) load balancer that uses a global anycast IP and terminates SSL at the edge of Google's network. The Google-managed SSL certificate leverages Certificate Authority Service to automatically provision and renew TLS certificates (using ACME protocol) for domains specified in the Ingress manifest. This is distinct from a Service type LoadBalancer, which creates a regional network load balancer (L4) that cannot terminate SSL without a separate proxy.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Deploying applications — study guide chapter
Learn the concepts, then practise the questions
Deploying applications practice questions
Targeted practice on this topic area only
All PCD questions
500 questions across all exam domains
Google Professional Cloud Developer study guide
Full concept coverage aligned to exam objectives
PCD practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise PCD questions linked to Designing highly scalable, available, and reliable cloud-native applications.
Practise PCD questions linked to Building and testing applications.
Practise PCD questions linked to Deploying applications.
Practise PCD questions linked to Integrating Google Cloud services.
Practise PCD questions linked to Managing application performance monitoring.
Practise PCD questions linked to PCD fundamentals.
Practise PCD questions linked to PCD scenario.
Practise PCD questions linked to PCD troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Deploying applications — This question tests Deploying applications — Read the scenario before looking for a memorised answer..
The correct answer is: Ingress with Google-managed SSL certificate — An Ingress with a Google-managed SSL certificate is the correct choice because it provides a single stable IP address via a global forwarding rule, terminates SSL at the Google Cloud HTTP(S) load balancer, and routes traffic to the GKE Deployment. This approach offloads SSL decryption from the application pods and uses a managed certificate that auto-renews, meeting both the stable IP and SSL termination requirements.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This PCD practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCD exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.