Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

A media streaming enterprise is provisioning infrastructure on Google Cloud for a new real-time video processing pipeline. The architecture requires deploying a private GKE cluster for processing microservices and a set of Compute Engine virtual machines for legacy media encoding. The security team mandates that the GKE control plane must not be accessible from the public internet and must restrict administrative access strictly to the company's internal management subnet. Additionally, automated deployment pipelines provisioning the virtual machines must use least-privilege identity management without granting administrative control over service accounts.

Which TWO actions should the Cloud Architect implement to satisfy these security and operational requirements?

  1. Configure control plane authorized networks on the private GKE cluster to restrict master endpoint access to the internal management subnet range.Answer
  2. Grant the pipeline deployment service account the Service Account User role (roles/iam.serviceAccountUser) on the specific service account attached to the Compute Engine instances.Answer
  3. C
    Grant the pipeline deployment service account the Service Account Admin role (roles/iam.serviceAccountAdmin) to allow attaching service accounts to Compute Engine instances.
  4. D
    Rely solely on Private Google Access and VPC Service Controls without defining control plane authorized networks on the GKE cluster.
  5. E
    Assign the Editor primitive role (roles/editor) to the deployment pipeline service account to ensure sufficient permissions for provisioning compute resources.

Answer

The correct configurations are restricting GKE master access via control plane authorized networks to the internal management subnet range and granting the Service Account User role (roles/iam.serviceAccountUser) on the target service account to the deployment pipeline.
Configuring control plane authorized networks ensures that administrative traffic to the GKE control plane is limited strictly to approved subnets such as the internal management subnet. Furthermore, assigning the Service Account User role to the deployment pipeline provides the exact least-privilege permission required to bind a service account to a Compute Engine virtual machine during provisioning.

Step-by-Step Solution

1
Evaluate GKE Control Plane Security Requirements
Creating a private cluster hides node IP addresses, but restricting master access to specific CIDR blocks requires configuring Control Plane Authorized Networks.
Control Plane Authorized Networks restrict access to the public or private cluster endpoint to authorized IP ranges.
2
Evaluate Compute Engine IAM Least Privilege Requirements
Provisioning VMs that attach specific service accounts requires the identity deploying the VM to possess the `roles/iam.serviceAccountUser` permission on the target service account.
This permission allows an identity to impersonate or run jobs under a service account without granting administrative powers like creating or deleting keys.

Key Concept

GKE Private Cluster Control Plane Access and Least-Privilege Compute IAM
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic