Google Professional Cloud Developer Question 132
Select 3Google Cloud PlatformYou are developing a cloud-native application deployed on a Google Kubernetes Engine (GKE) cluster. The application consists of multiple microservices, and you need to secure service-to-service communication within the cluster. Which of the following steps should you take to enforce service-level security and prevent unauthorized communication between services?
- A
Implement Kubernetes Network Policies to restrict traffic between pods based on labels.
- B
Use a service mesh like Istio to enforce mutual TLS (mTLS) for service-to-service communication.
- C
Enable Cloud Armor to restrict external traffic to the cluster.
- D
Configure Kubernetes namespaces to isolate services logically.
- E
Set up HTTP Basic Authentication between all services.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure service-to-service communication in a Kubernetes cluster, you should use Kubernetes Network Policies to control traffic flow, a service mesh like Istio to enable mutual TLS, and Kubernetes namespaces to logically isolate services. These methods ensure robust security by addressing network-level, application-level, and organizational isolation concerns. Cloud Armor and HTTP Basic Authentication are not relevant for internal service-to-service security in this scenario.
- A. Correct.
Correct: Kubernetes Network Policies allow you to define rules that restrict traffic between pods based on labels and namespaces, providing a layer of network-level security.
- B. Correct.
Correct: A service mesh like Istio can enforce mutual TLS (mTLS) to secure communication between services, ensuring that traffic is encrypted and authenticated.
- C. Incorrect.
Incorrect: Cloud Armor is designed to protect external web applications and services from threats and does not secure internal service-to-service communication within a Kubernetes cluster.
- D. Correct.
Correct: Using Kubernetes namespaces provides logical isolation between services, which can help in segmenting and securing workloads.
- E. Incorrect.
Incorrect: HTTP Basic Authentication is not suitable for securing service-to-service communication in a modern cloud-native environment as it lacks robust encryption and scalability.