A media company runs a global site behind a global external Application Load Balancer and wants TLS handled at Google's edge so backend VMs spend their CPU on the application. Where is TLS terminated and where is the certificate held?
Show answer and explanation
Answer: D
For a global external Application Load Balancer, TLS is terminated at the target HTTPS proxy, which runs at Google's edge points of presence. That proxy holds the SSL certificates, and Google-managed certificates are provisioned and renewed automatically. Because the handshake happens at the edge, backends receive decrypted requests and spend CPU on the application. Traffic to the backends can still be re-encrypted when the design requires it. A certificate on each VM or on a regional internal proxy does not serve this global edge role.
Why the other options are wrong
- A. Installing certificates on each VM makes every instance perform its own TLS handshakes. That keeps the cryptographic cost on the backends, which is exactly what the media company wants to avoid.
- B. SSL policies attach to target proxies and set which TLS versions and ciphers clients may use. There is no backend service policy that handles client handshakes, and SSL policies hold no certificates.
- C. A regional internal proxy serves traffic inside a VPC and is not part of the global edge. It cannot terminate public client connections for a global external balancer.
Exam tip. Client certificates for an external Application Load Balancer live on the target proxy.