Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

An automotive technology company is setting up Google Cloud compute infrastructure to process real-time telemetry streams from connected vehicles. The architecture requires provisioning a Google Kubernetes Engine (GKE) cluster to run containerized microservices that write processed metrics to BigQuery and Cloud Storage. Corporate security policies require that the cluster control plane is secured against unrestricted public internet access while allowing management access from designated corporate CIDR blocks, and that container pods authenticate to Google Cloud APIs using fine-grained, least-privilege IAM roles without relying on exported long-lived service account keys. Which deployment approach meets these requirements?

  1. Provision a private GKE cluster with Control Plane Authorized Networks restricted to corporate IP ranges, and enable Workload Identity to bind Kubernetes service accounts to dedicated IAM service accounts.Answer
  2. B
    Provision a public GKE cluster using default node service accounts, and assign the primitive Editor role to the cluster service account to ensure all microservices can read and write to BigQuery and Cloud Storage.
  3. C
    Provision a private GKE cluster while leaving Control Plane Authorized Networks disabled so that build servers and management tools can reach the master endpoint from any external network address.
  4. D
    Provision a private GKE cluster with authorized networks, but grant the deployment pipeline service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) so it can attach service accounts to cluster node pools.

Answer

Provisioning a private GKE cluster with Control Plane Authorized Networks configured for corporate IP ranges, combined with Workload Identity for pod-level IAM authentication, satisfies all security and connectivity requirements.
The correct recommendation is to provision a private GKE cluster configured with Control Plane Authorized Networks and Workload Identity. Control Plane Authorized Networks restrict public endpoint access strictly to designated corporate CIDRs, satisfying network isolation rules. Workload Identity securely binds Kubernetes service accounts used by microservices directly to fine-grained IAM service accounts, eliminating key management overhead and fulfilling least-privilege requirements.

Step-by-Step Solution

1
Analyze security boundaries for GKE control plane access.
Enabling Control Plane Authorized Networks ensures that only specified corporate IP ranges can communicate with the Kubernetes API server endpoint.
Prevents unauthorized internet traffic from reaching the cluster management plane.
2
Configure pod identity management using Google Cloud best practices.
Enabling Workload Identity maps Kubernetes service accounts (KSAs) to Google IAM service accounts (GSAs).
Allows containerized microservices to securely access BigQuery and Cloud Storage with fine-grained IAM roles without managing exported JSON keys.

Key Concept

GKE Private Cluster Security and Workload Identity Provisioning
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic