Google Cloud Professional Cloud Security Engineer Practice Exam

If your organization has an on-premises PKI system and needs to scale certificate issuance for HTTP load balancers, what is a viable solution?

1. Use self-signed certificates for all load balancers

2. Implement a subordinate CA in Google Certificate Authority Service

3. Relocate the entire PKI to the cloud

4. Manually issue certificates through a local process

The correct answer is: Implement a subordinate CA in Google Certificate Authority Service

Implementing a subordinate Certificate Authority (CA) in Google Certificate Authority Service is a viable solution for scaling certificate issuance for HTTP load balancers when an organization has an on-premises PKI system. This approach allows the existing PKI infrastructure to remain in place while leveraging the scalability and efficiency of Google’s managed service for certificate management. By creating a subordinate CA, the organization can automate the issuance of certificates that are trusted within its internal infrastructure and can have seamless integration with Google's services. This solution provides several key benefits, including the ability to centrally manage and issue certificates via the Google Cloud platform, increased security through the management of the CA lifecycle without needing to reconfigure network points each time, and reduced operational overhead by automating workflows for certificate issuance and renewal. This option allows organizations to scale their certificate management capabilities without the need for a complete overhaul of their existing PKI architecture or relying solely on self-signed certificates, which are typically less trusted and require additional management overhead. Additionally, relocating the entire PKI to the cloud might not be necessary and could involve considerable effort and risk. Manually issuing certificates through a local process can lead to scalability challenges and increased risk of errors over time, making it less efficient as load balancer needs grow.