Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ340

Deploying applications

A team maintains an application that aggregates news articles from many different sources. Its monitoring dashboard provides publicly accessible, real-time reports and runs as a web application on a Compute Engine instance. External stakeholders and analysts must access these reports through a secure channel without authentication. How should this secure channel be configured?

  • A Add a public IP address to the instance. Use the service account key of the instance to encrypt the traffic.
  • B Use Cloud Scheduler to trigger Cloud Build every hour to create an export from the reports. Store the reports in a public Cloud Storage bucket.
  • C Add an HTTP(S) load balancer in front of the monitoring dashboard. Configure Identity-Aware Proxy to secure the communication channel.
  • D Add an HTTP(S) load balancer in front of the monitoring dashboard. Set up a Google-managed SSL certificate on the load balancer for traffic encryption.
Explanation

An external HTTP(S) load balancer with a Google-managed SSL certificate provides HTTPS/TLS encryption between public clients and the dashboard without requiring users to authenticate. Identity-Aware Proxy is unsuitable because it verifies user identity and enforces authorization. Google Cloud documents that TLS encrypts information in transit between a client and a load balancer, and that Google-managed SSL certificates are supported by external Application Load Balancers.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!