A cloud architect is preparing to provision a private Google Kubernetes Engine (GKE) cluster in GCP to host an internal microservice. Security governance mandates that node instances must not be publicly exposed and that principles of least privilege must be applied to node identity. Which of the following actions should be taken during cluster provisioning to satisfy these requirements? (Select TWO answers.)
- Provision the cluster with private nodes and enable Control Plane Authorized Networks to restrict access to management endpoints.Cevap
- Assign a dedicated custom service account with minimal required roles to the cluster worker nodes instead of using the default Compute Engine service account.Cevap
- CAssign the primitive Editor role to the cluster node service account to ensure worker nodes can provision any needed GCP resource automatically.
- DDisable Control Plane Authorized Networks so that cluster administrators can access the master endpoint from any public IP without network restrictions.
- EGrant the Service Account Admin role to developers on the node service account so they can attach it when launching new node pools.
Cevap
Provisioning private cluster nodes combined with Control Plane Authorized Networks ensures network isolation, while assigning a dedicated custom service account with minimal IAM permissions guarantees identity isolation.
Provisioning private nodes alongside Control Plane Authorized Networks ensures node instances have no public IPs and control plane access is restricted. Configuring a custom service account with minimal roles enforces least privilege for workload credentials on cluster nodes.
Adım Adım Çözüm
Anahtar Kavram
GKE Private Cluster Provisioning & Node Service Account Security
Tahmini Süre:1m 0s