What is the role of the host project in a Shared VPC configuration for GKE?

It hosts the GKE cluster and its nodes

It manages IAM policies for the cluster's service account

It owns the VPC network and its subnets

It provides the Kubernetes API endpoint for the cluster

What is the purpose of an IP Masquerade policy in GKE?

To allow Pods to communicate with each other

To change the destination IP address of inbound traffic to Pods

To block all outbound traffic from Pods

To change the source IP address of outbound traffic from Pods

You have a private GKE cluster with a private control plane endpoint. Your security team requires that only the IP range 192.168.1.0/24 can access the control plane. You have already enabled master authorized networks. What should you do to enforce this restriction?

Use IAM roles to restrict who can access the control plane.

Create a firewall rule that allows traffic to the master IP range only from 192.168.1.0/24.

Disable the public endpoint and rely on VPC firewall rules.

Update the authorized networks list to include only 192.168.1.0/24.

What is the purpose of the DNS-based endpoint (e.g., endpoint.p.gke.goog) for a private GKE cluster?

To provide a public hostname for the control plane that is accessible from the internet

To provide a stable hostname for the control plane that does not depend on a static IP address

To provide a hostname for the nodes to access the control plane

To provide a hostname for the control plane that is accessible from on-premises only

When creating a GKE cluster with alias IPs enabled, what must be specified for the cluster to be VPC-native?

A custom subnet mode VPC with no secondary ranges

A VPC network and a subnet with secondary ranges for Pods and Services

A legacy network with IP forwarding enabled

A VPC network with a single large primary range for all resources

Google CloudProfessional Cloud Network Engineer

Domain 2Objective 4

2.4 Configuring and Maintaining GKE Clusters. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 3)

Part of the Section 2: Implementing a VPC network (~20% of the exam) domain, which accounts for ~20% of the PROFESSIONAL-CLOUD-NETWORK-ENGINEER exam.

20questions here

4free pages

11concepts

~20%of the exam

Questions 11–15

11foundation · easy
What is the role of the host project in a Shared VPC configuration for GKE?
Select an answer first
12foundation · easy
What is the purpose of an IP Masquerade policy in GKE?
Select an answer first
13application · medium
You have a private GKE cluster with a private control plane endpoint. Your security team requires that only the IP range 192.168.1.0/24 can access the control plane. You have already enabled master authorized networks. What should you do to enforce this restriction?
Select an answer first
14foundation · easy
What is the purpose of the DNS-based endpoint (e.g., endpoint.p.gke.goog) for a private GKE cluster?
Select an answer first
15foundation · easy
When creating a GKE cluster with alias IPs enabled, what must be specified for the cluster to be VPC-native?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-NETWORK-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-NETWORK-ENGINEER” is a trademark of its owner, used for identification only.