Google Professional Cloud Network Engineer Question 178
Single answerGoogle Cloud PlatformYour organization is deploying a GKE cluster to handle production workloads. Security is a top priority, and you need to ensure that the Kubernetes nodes do not have public IP addresses while still allowing them to pull container images and communicate with Google APIs securely. What is the best configuration to achieve this?
- A
Create a private cluster with a private node pool and enable Private Google Access.
- B
Create a public cluster with a private node pool and enable Private Google Access.
- C
Create a private cluster with a private node pool and use a NAT gateway to allow internet access.
- D
Create a public cluster with a public node pool and use a NAT gateway to allow internet access.
Show answer and explanation
Correct answer: A
Explanation
When security is a top priority, using private clusters with private node pools ensures that all components remain within a private network. Enabling Private Google Access allows nodes to securely access Google APIs without requiring public IP addresses or additional NAT gateways. This minimizes the attack surface and simplifies configuration while maintaining secure connectivity.
- A. Correct.
This is the correct answer. A private cluster ensures that the control plane and nodes have private IPs, and enabling Private Google Access allows the nodes to access Google APIs securely without requiring a NAT gateway or public IPs.
- B. Incorrect.
This option is incorrect because a public cluster exposes the control plane to the public internet, which violates the security requirement.
- C. Incorrect.
This option is partially correct but not ideal because while a private cluster and NAT gateway would provide secure internet access, enabling Private Google Access is a simpler and more secure solution for accessing Google APIs specifically.
- D. Incorrect.
This option is incorrect because using a public cluster with public node pools does not meet the security requirement of avoiding public IP addresses for the nodes.