Google Professional Cloud Network Engineer Question 327
Select 3Google Cloud PlatformYou are configuring network policies for a Google Kubernetes Engine (GKE) cluster to ensure that only the frontend pods can communicate with the backend pods, and no other pods in the cluster should have access to the backend. Which of the following actions should you take to correctly configure the GKE network policy?
- A
Create a NetworkPolicy that allows ingress traffic to the backend pods from pods in the frontend namespace, using appropriate labels for selection.
- B
Create a NetworkPolicy that allows ingress traffic to the backend pods from all namespaces, but restricts traffic to a specific port.
- C
Create a NetworkPolicy that denies ingress traffic to the backend pods from all sources by default and only allows traffic from frontend pods using the correct labels.
- D
Ensure that the backend pods have a label selector matching the NetworkPolicy's podSelector configuration.
- E
Enable GKE's Dataplane V2 to enforce NetworkPolicy configurations at the network level.
Show answer and explanation
Correct answers: A, C, D
Explanation
To restrict access to the backend pods and allow communication only with the frontend pods, you need to create a NetworkPolicy that denies all ingress traffic by default and explicitly allows traffic from the frontend pods based on labels or namespaces. The backend pods must also have labels matching the NetworkPolicy's podSelector for the policy to apply. Enabling Dataplane V2 is not a mandatory step for enforcing network policies.
- A. Correct.
This is correct. To allow communication between the frontend and backend pods, you need to create a NetworkPolicy that explicitly allows ingress traffic from frontend pods based on labels or namespaces.
- B. Incorrect.
This is incorrect. Allowing traffic from all namespaces does not satisfy the requirement to restrict access to the backend pods to only the frontend.
- C. Correct.
This is correct. Denying all ingress traffic by default and then explicitly allowing traffic from the frontend pods ensures that only the frontend can communicate with the backend.
- D. Correct.
This is correct. The backend pods need to have appropriate labels that match the podSelector in the NetworkPolicy for the policy to take effect.
- E. Incorrect.
This is incorrect. While enabling Dataplane V2 can enhance performance and observability of policies, it is not directly required to configure or enforce NetworkPolicy rules.