Google Professional Cloud Network Engineer Question 342
Select 3Google Cloud PlatformYou are tasked with setting up a Google Kubernetes Engine (GKE) cluster that requires external HTTP/HTTPS access to its workloads. The workloads must also securely communicate with a backend service deployed in a private subnet within the same Virtual Private Cloud (VPC). Which of the following configurations should you include to meet these requirements?
- A
Enable HTTP/HTTPS Load Balancer and configure a backend service for external access.
- B
Configure Cloud NAT to allow the GKE cluster to access the internet without exposing its private IPs.
- C
Use a private Google Access configuration in the VPC for backend service communication.
- D
Create a firewall rule allowing ingress traffic on ports 80 and 443 to the GKE nodes.
- E
Enable Ingress for the GKE cluster to route external traffic to the workloads.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the requirements of external HTTP/HTTPS access and secure communication with a private backend service, you need to enable an HTTP/HTTPS Load Balancer for external access, configure Cloud NAT for internet access without exposing private IPs, and enable Ingress to route external traffic to the workloads. Private Google Access and direct firewall rules for GKE nodes are unnecessary for this specific use case.
- A. Correct.
Correct: To provide external HTTP/HTTPS access to the workloads, you need an HTTP/HTTPS Load Balancer connected to a backend service.
- B. Correct.
Correct: Cloud NAT is required to allow the GKE cluster to access the internet without exposing its private IPs.
- C. Incorrect.
Incorrect: Private Google Access is not required for communication between the GKE cluster and a backend service within the same VPC. It is used for accessing Google APIs and services from private IPs.
- D. Incorrect.
Incorrect: A firewall rule allowing ingress traffic on ports 80 and 443 to the GKE nodes is not recommended. Instead, use an HTTP/HTTPS Load Balancer to manage external traffic securely.
- E. Correct.
Correct: Enabling Ingress is necessary to route external traffic from the Load Balancer to the workloads within the GKE cluster.