Google Professional Cloud Network Engineer Question 185
Single answerGoogle Cloud PlatformYour company is deploying a GKE cluster in a production environment and requires strict network security. The cluster should only be accessible from a specific on-premises network via a VPN connection, and external access to the Kubernetes API should be disabled. Which type of control plane endpoint should you choose?
- A
Public control plane endpoint with authorized networks enabled
- B
Private control plane endpoint
- C
Public control plane endpoint with Cloud Armor for API protection
- D
Private control plane endpoint with a bastion host for access
Show answer and explanation
Correct answer: B
Explanation
A private control plane endpoint is the most appropriate choice for scenarios requiring strict network security and disabling external access to the Kubernetes API. It ensures that the control plane is only accessible via internal IPs, such as through a VPN connection to an on-premises network, meeting the requirements outlined in this scenario.
- A. Incorrect.
Public control plane endpoint with authorized networks enabled allows access to the Kubernetes API from specific IP ranges. However, this still exposes the control plane endpoint to the public internet, which does not meet the requirement to disable external access.
- B. Correct.
Private control plane endpoint restricts access to the Kubernetes API to internal IP addresses only, ensuring that API access is limited to the on-premises network via the VPN connection. This satisfies the requirement for strict network security and disables external access.
- C. Incorrect.
Public control plane endpoint with Cloud Armor for API protection provides additional security for public control plane access but does not satisfy the requirement to disable external access entirely.
- D. Incorrect.
Private control plane endpoint with a bastion host introduces a separate access mechanism but still restricts API access to internal traffic. However, the use of a bastion host is unnecessary in this scenario since the VPN connection already secures the environment.