Google Professional Cloud Network Engineer Question 179
Single answerGoogle Cloud PlatformYour organization is deploying a GKE cluster for a sensitive internal application. The application should only be accessible over a private network and must not expose any component to the public internet. Which configuration should you choose to meet this requirement?
- A
Use a private cluster with private nodes and disable public endpoint access for the control plane.
- B
Use a public cluster with private nodes and restrict access using firewall rules.
- C
Use a private cluster with public nodes and configure Cloud NAT for outbound internet traffic.
- D
Use a public cluster with public nodes and restrict access using IAM policies.
Show answer and explanation
Correct answer: A
Explanation
A private cluster with private nodes ensures that both the control plane and nodes are accessible only through private IP addresses. Disabling the public endpoint for the control plane further ensures that no component of the cluster is exposed to the public internet, making it suitable for sensitive internal applications.
- A. Correct.
This option ensures the cluster nodes and control plane are only accessible via private IPs, meeting the requirement for internal-only access. Disabling the public endpoint for the control plane further secures the cluster.
- B. Incorrect.
While this configuration uses private nodes, a public cluster exposes the control plane to the public internet, which contradicts the requirement to avoid public exposure.
- C. Incorrect.
Using a private cluster with public nodes does not fully meet the requirement, as public nodes can still have external IPs, potentially exposing the application.
- D. Incorrect.
Public clusters with public nodes do not meet the requirement since both the control plane and nodes could be accessible from the public internet, even with IAM restrictions.