Exam Professional Cloud Network Engineer topic 1 question 156 discussion

Actual exam question from Google's Professional Cloud Network Engineer

Question #: 156
Topic #: 1

[All Professional Cloud Network Engineer Questions]

You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters. Due to IP address exhaustion of the RFC 1918 address space in your enterprise, you plan to use privately used public IP space for the new clusters. You want to follow Google-recommended practices. What should you do after designing your IP scheme?

A. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters. Re-use the secondary address range for the pods across multiple private GKE clusters.
B. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters, Re-use the secondary address range for the services across multiple private GKE clusters.
C. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --enable-ip-alias and --enable-private-nodes.
D. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected: --disable-default-snat, --enable-ip-alias, and --enable-private-nodes.

Show Suggested Answer

Suggested Answer: D 🗳️

by bnba44 at Dec. 21, 2023, 2:18 p.m.

Comments

Submit Cancel

n2183712847

3 months, 3 weeks ago

Selected Answer: D

D is correct answer

upvoted 1 times

...

nabal82

1 year, 1 month ago

Sorry, D is right. https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips?hl=pt-br#enable_pupis

upvoted 1 times

...

nabal82

1 year, 1 month ago

B is right. https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips?hl=pt-br#enable_pupis

upvoted 1 times

...

nabal82

1 year, 1 month ago

Selected Answer: D

D is right

upvoted 3 times

...

bnba44

1 year, 1 month ago

Selected Answer: C

SNAT deactivated by default

upvoted 1 times

desertlotus1211

11 months, 3 weeks ago

GKE by default implements SNAT on the nodes to public IP destinations. If you have configured the Pod CIDR to use external IP addresses, the SNAT rules apply to Pod-to-Pod traffic. To avoid this you have 2 options: Create your cluster with the --disable-default-snat flag. For more details about this flag, refer to IP masquerading in GKE. Configure the configMap ip-masq-agent including in the nonMasqueradeCIDRs list at least the Pod CIDR, the Service CIDR, and the nodes subnet.

upvoted 1 times

...

desertlotus1211

11 months, 3 weeks ago

Wrong it's enabled

upvoted 2 times

...