Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

An enterprise financial organization is deploying a private Google Kubernetes Engine (GKE) cluster to host compliance-sensitive microservices. Operational policy dictates that worker nodes must not have public IP addresses and that the GKE control plane private endpoint must be accessible only to security operators connecting via an existing Cloud VPN from an on-premises network subnet (10.200.0.0/24). Public internet access to the control plane must be completely disabled. Which configuration architectural strategy should you implement to provision this cluster securely while enabling operational management?

  1. Provision a private GKE cluster with the private endpoint enabled and public endpoint disabled, and configure Control Plane Authorized Networks to allow the 10.200.0.0/24 subnet.Answer
  2. B
    Provision a private GKE cluster with the private endpoint enabled and public endpoint disabled, relying on automatic VPC network routing over Cloud VPN to grant control plane access without specifying authorized networks.
  3. C
    Grant security operators the Project Owner primitive IAM role so their authenticated credentials automatically bypass GKE control plane network restrictions.
  4. D
    Grant security operators the Service Account Admin role to allow administrative access to cluster management service accounts across the private network endpoint.

Answer

Provision a private GKE cluster with the private endpoint enabled and public endpoint disabled, and configure Control Plane Authorized Networks to allow the 10.200.0.0/24 subnet.
The correct strategy is to provision a private GKE cluster with the private endpoint enabled and public endpoint disabled, while configuring Control Plane Authorized Networks to allow the on-premises subnet (10.200.0.0/24). GKE control planes are hosted in a Google-managed tenant VPC connected via VPC Network Peering. When public access is disabled, access from remote networks connected via Cloud VPN or Dedicated Interconnect requires explicitly adding the client IP ranges to the Control Plane Authorized Networks configuration.

Step-by-Step Solution

1
Identify cluster isolation requirements
Worker nodes must have private IPs only, and the control plane must not be exposed to the public internet.
Meets compliance policies disabling public endpoints for GKE compute and master nodes.
2
Determine master endpoint accessibility mechanism
Enable private endpoint access and disable public endpoint access during GKE cluster creation.
Ensures the control plane endpoint is assigned an internal IP accessible via VPC and connected networks.
3
Configure Control Plane Authorized Networks
Explicitly add the on-premises management subnet (10.200.0.0/24) to the cluster's Control Plane Authorized Networks list.
Private control plane endpoints enforce strict IP authorization filters; non-VPC custom CIDRs reaching the cluster over VPN/Interconnect must be explicitly permitted.

Key Concept

Private GKE Cluster Control Plane Security & Authorized Networks
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic