Google Professional Cloud Network Engineer exam dumps: questions 301 to 400 of 789

Correct answers: A, B, D

• A. Correct.

  Enabling the private endpoint ensures that the control plane is accessible only through internal private IP addresses.

• B. Correct.

  Disabling the public endpoint ensures that the control plane is not accessible over the public internet, aligning with the requirement to keep the control plane private.

• C. Incorrect.

  Cloud NAT is used to provide internet access for private instances, but in this scenario, it is not required since Private Google Access enables nodes to communicate with Google APIs without public IPs.

• D. Correct.

  Private Google Access allows cluster nodes to access Google APIs (such as Container Registry or Cloud Storage) using private IPs, which fulfills the requirement.

• E. Incorrect.

  A VPN connection is not necessary for accessing the private control plane endpoint unless there is a specific requirement to connect from an on-premises network.

Correct answers: A, B, D

• A. Correct.

  Enabling the private cluster option ensures that the nodes in the cluster do not have external IPs and the control plane is accessible only via private IPs.

• B. Correct.

  Configuring a CIDR range for the master authorized networks allows you to restrict access to the control plane to specific internal IP ranges.

• C. Incorrect.

  Creating nodes with external IPs would violate the requirement to have nodes without external IPs. This option is incorrect.

• D. Correct.

  Setting up a Cloud NAT allows nodes without external IPs to access the internet for things like pulling container images or applying updates. This is necessary for proper functionality.

• E. Incorrect.

  Disabling the master authorized networks feature would make the control plane fully private, but this would prevent the configuration of specific CIDR ranges for access, which violates the requirements. This option is incorrect.

Correct answers: A, B, D

• A. Correct.

  Correct: Enabling the private endpoint ensures that the Kubernetes API server can be accessed securely through a private IP address, meeting the requirement for private communication with the control plane.

• B. Correct.

  Correct: Disabling public endpoint access ensures that the control plane is not exposed to the public internet, satisfying the security requirement.

• C. Incorrect.

  Incorrect: While IP aliasing is required for GKE clusters, it is not directly related to the private control plane endpoint configuration described in this scenario.

• D. Correct.

  Correct: A VPN or Interconnect is necessary to enable private communication between the on-premises network and the Google Cloud VPC, allowing secure access to the private endpoint.

• E. Incorrect.

  Incorrect: Configuring a NAT gateway is not required for the control plane or API access. NAT is typically used to enable outbound internet access for the cluster's nodes, which is not mentioned as a requirement in this scenario.

Correct answers: A, B, D

• A. Correct.

  Correct: Enabling private endpoints and private nodes is required to ensure both the nodes and control plane endpoint are private.

• B. Correct.

  Correct: Configuring authorized networks ensures that only specific internal IP ranges can access the private control plane endpoint.

• C. Incorrect.

  Incorrect: While Cloud NAT can be used for outbound internet access from nodes, it is not directly related to configuring the private control plane endpoint.

• D. Correct.

  Correct: Disabling the public endpoint ensures that the control plane API server is only accessible via the private endpoint.

• E. Incorrect.

  Incorrect: While a VPN or Interconnect is useful for hybrid connectivity, it is not mandatory for configuring a private control plane endpoint.

Correct answer: A

• A. Correct.

  This is correct. Configuring authorized networks for the Kubernetes API server (control plane) allows you to restrict access to only specific IP ranges. This can be done using the GCP Console or the gcloud CLI.

• B. Incorrect.

  This is incorrect. Kubernetes Network Policies are used to control traffic between Pods within the cluster and cannot restrict access to the Kubernetes control plane.

• C. Incorrect.

  This is incorrect. Firewall rules alone cannot control access to the Kubernetes API server. Authorized networks are the appropriate method for this purpose.

• D. Incorrect.

  This is incorrect. Modifying the kubeconfig file does not restrict access to the control plane but instead configures how a client interacts with it.