Google Professional Cloud Network Engineer Question 41
Single answerGoogle Cloud PlatformYour organization is migrating its containerized applications to Google Kubernetes Engine (GKE). As part of the security requirements, you need to implement micro-segmentation to ensure that workloads communicate only with authorized services. Which approach should you take to enforce micro-segmentation in GKE?
- A
Use network tags to create VPC firewall rules that allow or deny traffic between workloads.
- B
Use Kubernetes Network Policies to define rules for pod-to-pod communication.
- C
Assign unique service accounts to each workload and configure IAM policies to restrict permissions.
- D
Enable Binary Authorization to restrict which images can be deployed to the cluster.
Show answer and explanation
Correct answer: B
Explanation
Kubernetes Network Policies are the most appropriate solution for implementing micro-segmentation in GKE. They allow you to define which pods can communicate with each other and with external resources, providing granular control over network traffic at the pod level. This is essential for meeting security requirements in a containerized environment.
- A. Incorrect.
Network tags are used in VPC firewall rules for controlling traffic at the VM or instance level, but they are not granular enough to enforce pod-to-pod communication rules necessary for micro-segmentation in GKE.
- B. Correct.
Kubernetes Network Policies are specifically designed to control traffic between pods, enabling fine-grained micro-segmentation for workloads within a GKE cluster.
- C. Incorrect.
Service accounts and IAM policies are useful for controlling access to Google Cloud resources, but they do not enforce network-level communication rules between workloads.
- D. Incorrect.
Binary Authorization is a security feature to ensure only trusted container images are deployed, but it does not address network segmentation or communication between workloads.