What is the primary purpose of enabling alias IP ranges when creating a VPC-native GKE cluster?

To enable the cluster to use a different VPC network than the nodes

To allow Pods and Services to use IP addresses from the VPC's primary subnet range

To assign a separate public IP address to each Pod and Service

To enable Pods and Services to have IP addresses from dedicated secondary ranges in the VPC subnet

A private GKE cluster has a private control plane endpoint. The cluster is accessed by administrators from a bastion host with a static IP. The security team wants to ensure that only the bastion host can access the control plane. Which configuration should you use?

Disable the public endpoint and rely on IAM roles.

Enable master authorized networks and set the authorized network to the bastion host's IP /32.

Create a firewall rule that allows traffic to the master IP range only from the bastion host.

Use the DNS-based endpoint and rely on VPC firewall rules.

You have a GKE cluster where Pods need to access an on-premises database through a Cloud VPN. The on-premises firewall only allows traffic from the node IP range, not the Pod IP range. What should you configure to ensure the database sees the node IP as the source?

Apply an IP Masquerade policy that masquerades Pod traffic to the node IP for destinations in the on-premises CIDR.

Create a firewall rule in the VPC to allow Pod IPs to reach the VPN gateway.

Use a NAT gateway for all outbound traffic.

Disable IP Masquerade for all traffic.

What is the purpose of adding additional Pod ranges to an existing GKE cluster?

To improve the performance of the cluster

To enable the cluster to use a different VPC network

To expand the number of Pods that can be scheduled

To increase the number of nodes in the cluster

Google CloudProfessional Cloud Network Engineer

Domain 2Objective 4

2.4 Configuring and Maintaining GKE Clusters. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 1)

Part of the Section 2: Implementing a VPC network (~20% of the exam) domain, which accounts for ~20% of the PROFESSIONAL-CLOUD-NETWORK-ENGINEER exam.

20questions here

4free pages

11concepts

~20%of the exam

Questions 1–5

1foundation · easy
What is the primary purpose of enabling alias IP ranges when creating a VPC-native GKE cluster?
Select an answer first
2expert · hard
A private GKE cluster has a private control plane endpoint. The cluster is accessed by administrators from a bastion host with a static IP. The security team wants to ensure that only the bastion host can access the control plane. Which configuration should you use?
Select an answer first
3application · medium
You have a GKE cluster where Pods need to access an on-premises database through a Cloud VPN. The on-premises firewall only allows traffic from the node IP range, not the Pod IP range. What should you configure to ensure the database sees the node IP as the source?
Select an answer first
4foundation · easy
What is the purpose of adding additional Pod ranges to an existing GKE cluster?
Select an answer first
5foundation · easy
What is the primary technology that GKE Dataplane V2 uses for networking and network policies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-NETWORK-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-NETWORK-ENGINEER” is a trademark of its owner, used for identification only.