Practice Test 1 | Google Cloud Certified Professional Cloud Network Engineer | Dumps | Mock Test
Your company has applications deployed on Compute Engine instances. The company intends to containerize its applications and use GKE soon. You have been asked to design the cluster. The key network requirement is the isolation of the nodes in the cluster from the internet and the ability to block untrusted IP addresses from outside Google Cloud.
How can you achieve this?
A. Use Workload identity to control access
B. Configure a hybrid connectivity using either the Cloud VPN or Cloud Interconnect
C. Configure IAM to prevent access from untrusted actors
D. Configure the cluster as a private cluster
E. Configure the cluster to use authorized networks
Correct Answers: D and E
- Option A is incorrect. Workload Identity allows workloads in your GKE clusters to impersonate Identity and Access Management (IAM) service accounts to access Google Cloud services. This option is about the cluster initiating the access.
- Option B is incorrect. Hybrid connectivity cannot be used to isolate GKE clusters from the internet. They are useful for connecting Google and non-Google Cloud networks.
- Option C is incorrect. IAM can be used to limit who can access resources and what actions can be taken on those resources in Google Cloud. It does not restrict network connectivity
- Option D is correct. Private clusters run nodes that only have internal IP addresses, and do not allow public IPs over the internet to access the control plane endpoint.
- Option E is correct. Adding authorized networks can provide additional security benefits for your cluster. Authorized networks grant access to a specific set of addresses that you designate, such as those that originate from your environment. This can help protect access to your cluster in the case of a vulnerability in the cluster’s authentication or authorization mechanisms.
References:
Comments are closed, but trackbacks and pingbacks are open.