Your company deployed Cloud Next Generation Firewall Enterprise (Cloud NGFW Enterprise). You have already created a CA pool and a CA in Certificate Authority Service. You need to enable TLS…

Question

Options

• AGrant the network security service agent service account the privateca.certificateRequester role.
• BGrant the network security service agent service account the privateca.poolReader role. Create a
• CGrant the network security service agent service account the privateca.certificateRequester role.
• DGrant the network security service agent service account the privateca.certificateRequester role.

• A
  82% (28)
• B
  3% (1)
• C
  3% (1)
• D
  12% (4)

Explanation

For TLS inspection in Cloud NGFW Enterprise, the network security service agent (a Google-managed service account) must be able to issue certificates from your Certificate Authority Service (CAS) CA pool. This requires granting it the 'privateca.certificateRequester' role, which allows the service agent to request new certificates for inspecting TLS sessions by acting as an intermediate CA. Option A correctly identifies this role and the proper setup. Option B uses 'privateca.poolReader', which only grants read access to CA pool metadata - insufficient for issuing certificates. Options C and D differ in details around the TLS inspection policy creation or additional steps, but A captures the complete and correct minimum required configuration.

No community discussion yet for this question.