Google Professional Cloud Network Engineer Question 329
Select 2Google Cloud PlatformYou are managing a Kubernetes cluster in Google Kubernetes Engine (GKE) for your organization. The cluster handles both internal services and customer-facing workloads. Your security team has mandated that internal services should only communicate with each other and that external services should handle customer-facing traffic exclusively. How can you enforce this requirement using GKE network policies?
- A
Create a NetworkPolicy that allows traffic within the namespace for internal services and denies all ingress and egress traffic by default.
- B
Create a NetworkPolicy that allows ingress traffic only from specific pods and denies all other ingress traffic for internal services.
- C
Create a NetworkPolicy that restricts egress traffic to only the external world for customer-facing pods.
- D
Ensure the 'Enable network policy' option is disabled on the GKE cluster to allow unrestricted communication.
- E
Apply a NetworkPolicy to deny all ingress and egress traffic for both internal and customer-facing pods.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the security requirements, you need to create GKE network policies that isolate traffic between internal services and customer-facing workloads. Internal services should only communicate within their namespace and deny other traffic, while customer-facing workloads should be configured to handle external traffic as necessary. Options 1 and 2 achieve this by using network policies to control ingress and egress traffic for specific pods or namespaces. Options 3, 4, and 5 do not align with the requirements or would overly restrict communication.
- A. Correct.
Correct: This enforces communication within the namespace for internal services and restricts all other traffic, aligning with the security requirement.
- B. Correct.
Correct: This allows you to control which specific pods (internal services) can communicate while denying ingress from any other source.
- C. Incorrect.
Incorrect: Restricting egress traffic for customer-facing pods to the external world is not necessary for this scenario. Customer-facing pods should be able to handle external traffic, but this option does not ensure internal services are isolated.
- D. Incorrect.
Incorrect: Disabling the 'Enable network policy' option would allow unrestricted communication between all pods, which violates the security requirements.
- E. Incorrect.
Incorrect: Denying all ingress and egress traffic for both internal and customer-facing pods would block all communication, which is not the objective.