Google Professional Cloud Network Engineer Question 307
Select 3Google Cloud PlatformYou are managing a Google Kubernetes Engine (GKE) cluster and need to restrict access to the Kubernetes control plane by specifying a set of trusted IP ranges. Which of the following actions will correctly allow you to configure authorized networks for the control plane?
- A
Update the cluster’s authorized networks using the Google Cloud Console.
- B
Use the
gcloud container clusters updatecommand with the--enable-master-authorized-networksflag. - C
Modify the GKE node pool’s configuration to add authorized networks.
- D
Use the
gcloud container clusters updatecommand with the--master-authorized-networksflag to specify the IP ranges. - E
Enable Private Google Access on the subnet hosting the cluster to restrict access.
Show answer and explanation
Correct answers: A, B, D
Explanation
To restrict access to the Kubernetes control plane in GKE, you must configure authorized networks. This can be done either through the Google Cloud Console or by using the gcloud CLI commands with the appropriate flags (--enable-master-authorized-networks and --master-authorized-networks). These settings specify trusted IP address ranges that are permitted to access the control plane. Node pool configurations and Private Google Access are unrelated to this specific functionality.
- A. Correct.
Correct: The Google Cloud Console provides an option to update the authorized networks for the control plane under the GKE cluster settings.
- B. Correct.
Correct: Using the
gcloud container clusters updatecommand with--enable-master-authorized-networksenables the feature to specify authorized networks. - C. Incorrect.
Incorrect: Authorized networks are a control plane setting, not a node pool configuration. They cannot be modified at the node pool level.
- D. Correct.
Correct: The
--master-authorized-networksflag is used with thegcloud container clusters updatecommand to specify the IP ranges for authorized networks. - E. Incorrect.
Incorrect: Enabling Private Google Access is unrelated to configuring authorized networks for the Kubernetes control plane. It is used to allow private VMs to access Google APIs and services.