Google Professional Cloud Network Engineer Question 309
Single answerGoogle Cloud PlatformYour company has a Google Kubernetes Engine (GKE) cluster with a private control plane. The development team requires access to the cluster control plane from their on-premises network. The on-premises network uses the IP range 192.168.1.0/24. You need to securely allow access to the control plane. What is the appropriate action to take?
- A
Add 192.168.1.0/24 to the list of authorized networks for the cluster control plane.
- B
Configure a Cloud NAT to allow traffic from 192.168.1.0/24 to the control plane.
- C
Use a VPN or Interconnect from the on-premises network and configure the private IP range to match 192.168.1.0/24.
- D
Enable public endpoint access for the cluster control plane to allow traffic from any IP range.
Show answer and explanation
Correct answer: A
Explanation
To provide secure access to a GKE private control plane, you must add the on-premises network's IP range to the authorized networks list. This ensures only the specified IP range can access the control plane. Other options either do not address the requirement or introduce security risks.
- A. Correct.
Correct. Adding the on-premises network's IP range to the list of authorized networks for the cluster control plane allows secure and direct access to the control plane.
- B. Incorrect.
Incorrect. Cloud NAT is used for outbound traffic from private resources to the internet and does not control access to the cluster control plane.
- C. Incorrect.
Incorrect. While a VPN or Interconnect can provide connectivity between networks, it does not inherently manage control plane access. Authorized networks are still required for secure access.
- D. Incorrect.
Incorrect. Enabling public endpoint access opens the control plane to all IPs, which poses a serious security risk and is not a best practice in this scenario.