Google Professional Cloud Network Engineer Question 180
Single answerGoogle Cloud PlatformYour organization is deploying a Google Kubernetes Engine (GKE) cluster to run a sensitive workload that handles Personally Identifiable Information (PII). The workload requires access to on-premises systems via a VPN. You are tasked with ensuring that the cluster configuration minimizes public exposure and complies with security best practices. How should you configure the cluster nodes and node pools?
- A
Use a private cluster with private nodes and enable authorized networks for API server access.
- B
Use a private cluster with public nodes and enable firewall rules to restrict external access.
- C
Use a public cluster with private nodes and configure Cloud NAT for outbound internet access if needed.
- D
Use a public cluster with public nodes and enable Identity-Aware Proxy (IAP) for added security.
Show answer and explanation
Correct answer: A
Explanation
For sensitive workloads involving PII, security best practices recommend using a private cluster with private nodes. This setup ensures that both the nodes and the control plane are isolated from the public internet. Additionally, enabling authorized networks restricts API server access to a predefined set of trusted IP ranges. This approach minimizes the attack surface and complies with security requirements for sensitive data.
- A. Correct.
This option is correct. A private cluster with private nodes ensures that no nodes or node pools are given public IP addresses, reducing the risk of unauthorized access. Enabling authorized networks further restricts API server access to only trusted IP ranges.
- B. Incorrect.
Private clusters with public nodes expose the nodes to the internet, which is not a best practice for sensitive workloads. While firewall rules can add some protection, this configuration does not minimize public exposure.
- C. Incorrect.
A public cluster with private nodes does not fully restrict exposure to the public internet. Public clusters expose the control plane endpoint to the internet, which is not ideal for sensitive workloads.
- D. Incorrect.
Public nodes in a public cluster have public IP addresses, making them more vulnerable to attacks. While IAP adds an additional layer of security, it does not address the fundamental issue of public exposure.