Google Professional Cloud Network Engineer Question 182
Single answerGoogle Cloud PlatformYou are configuring a Google Kubernetes Engine (GKE) cluster for your company's production environment. The cluster needs to support internal systems that handle sensitive data and should not allow public access to the Kubernetes API server. Additionally, the cluster must be accessed only from your on-premises network via a secure VPN connection to Google Cloud. How should you configure the cluster's endpoint?
- A
Use a public control plane endpoint and configure IP whitelisting for your on-premises network.
- B
Use a private control plane endpoint and ensure your on-premises network is connected via a VPN or Interconnect.
- C
Use a public control plane endpoint with a private endpoint fallback.
- D
Use a private control plane endpoint and enable public access for external redundancy.
Show answer and explanation
Correct answer: B
Explanation
Using a private control plane endpoint ensures that the Kubernetes API server is accessible only within the internal network, which is crucial for sensitive data and production environments. By connecting the on-premises network to Google Cloud via VPN or Interconnect, you create a secure communication channel that avoids exposing the control plane to the public internet. Public endpoints, even with IP whitelisting, increase the risk of unauthorized access and do not meet the security requirements for this scenario.
- A. Incorrect.
This option would expose the Kubernetes API to the public internet, even if IP whitelisting is applied. This is not ideal for sensitive data or production workloads requiring secure internal communication.
- B. Correct.
This is the correct option because a private control plane endpoint ensures the Kubernetes API is only accessible internally. By connecting your on-premises network via VPN or Interconnect, you can securely access the cluster without exposing it to the public internet.
- C. Incorrect.
This option provides no additional security benefits and still exposes the control plane to the public internet. It does not align with the need to restrict access to internal systems.
- D. Incorrect.
This option contradicts the purpose of using a private control plane endpoint by enabling public access, which would undermine the security requirements for handling sensitive data.