Google Professional Cloud Network Engineer Question 304
Select 3Google Cloud PlatformYou are tasked with creating a highly secure Google Kubernetes Engine (GKE) private cluster for a financial application. The private cluster must use a private control plane endpoint to restrict API server access only to internal clients within the organization's network. Which steps must you take to configure this setup correctly?
- A
Enable private endpoints and private nodes for the cluster.
- B
Configure authorized networks to restrict access to the control plane endpoint.
- C
Ensure that a Cloud NAT gateway is configured for outbound internet access from the nodes.
- D
Disable the public endpoint for the control plane.
- E
Use a VPN or Interconnect to connect on-premises resources to the private cluster.
Show answer and explanation
Correct answers: A, B, D
Explanation
To configure a private cluster with a private control plane endpoint, you must enable private endpoints and private nodes to ensure that both the nodes and control plane are fully private. Additionally, configuring authorized networks restricts access to the control plane endpoint to only the approved IP ranges. Disabling the public endpoint ensures there is no external access to the control plane. While Cloud NAT or a VPN/Interconnect can support additional use cases, they are not directly required for this specific setup.
- A. Correct.
Correct: Enabling private endpoints and private nodes is required to ensure both the nodes and control plane endpoint are private.
- B. Correct.
Correct: Configuring authorized networks ensures that only specific internal IP ranges can access the private control plane endpoint.
- C. Incorrect.
Incorrect: While Cloud NAT can be used for outbound internet access from nodes, it is not directly related to configuring the private control plane endpoint.
- D. Correct.
Correct: Disabling the public endpoint ensures that the control plane API server is only accessible via the private endpoint.
- E. Incorrect.
Incorrect: While a VPN or Interconnect is useful for hybrid connectivity, it is not mandatory for configuring a private control plane endpoint.