Google Professional Cloud Network Engineer Question 181
Single answerGoogle Cloud PlatformYou are configuring a Google Kubernetes Engine (GKE) cluster for a mission-critical application. The application must be managed securely, and your organization requires that all API traffic between your on-premises network and the Kubernetes control plane remain private. Which control plane endpoint configuration should you choose?
- A
Use a public control plane endpoint with authorized networks configured.
- B
Use a private control plane endpoint and ensure your on-premises network has connectivity to the cluster's VPC.
- C
Use a public control plane endpoint without configuring any authorized networks.
- D
Use a private control plane endpoint and enable Cloud NAT for outgoing control plane traffic.
Show answer and explanation
Correct answer: B
Explanation
To ensure secure and private API traffic between your on-premises network and the GKE control plane, you must use a private control plane endpoint. This configuration keeps the API traffic within the Google Cloud and your on-premises network, provided there is proper networking connectivity between them (e.g., via VPN or Interconnect). Public endpoints, even with authorized networks, do not meet the strict privacy requirement.
- A. Incorrect.
This option allows access to the control plane, but it exposes the endpoint to the public internet, even with authorized networks configured. This does not meet the requirement of keeping traffic private.
- B. Correct.
This option ensures that all control plane traffic remains private by using a private endpoint. It also ensures your on-premises network can communicate with the cluster's VPC, which is a requirement for private connectivity.
- C. Incorrect.
Using a public control plane endpoint without authorized networks configured exposes the endpoint to the public internet without restriction, which is highly insecure and does not meet the requirement for private traffic.
- D. Incorrect.
While enabling Cloud NAT allows outgoing traffic from private IPs, it does not secure the control plane endpoint itself. The private control plane endpoint is necessary to meet the requirements for private API traffic.