Exam Professional Cloud Network Engineer topic 1 question 217 discussion

Actual exam question from Google's Professional Cloud Network Engineer

Question #: 217
Topic #: 1

[All Professional Cloud Network Engineer Questions]

Your organization's application is running on a VPC-native GKE Standard cluster with public IP addresses. You need to configure access to the remote address range 35.100.0.0/16 through Cloud NAT, instead of using the GKE nodes' external IP addresses. SNAT is enabled on the cluster and needs to be configured. What should you do?

A. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Include the 35.100.0.0/16 range in the list.
B. Configure nonMasqueradeCIDRs in the ip-masq-agent ConfigMap. Remove the 35.100.0.0/16 range from the list.
C. Configure Cloud NAT and create an exclusion rule for any SNAT address translation.
D. Configure Cloud NAT with nonMasqueradeCIDRs, and enable SNAT with the same configuration to allow traffic to 35.100.0.0/16.

Show Suggested Answer

Suggested Answer: B 🗳️

by 1f01b87 at March 15, 2025, 8:03 p.m.

Comments

Submit Cancel

n2183712847

1 month, 2 weeks ago

Selected Answer: B

"instead of using the GKE nodes' external IP addresses" Remove

upvoted 1 times

...

lolanczos

2 months ago

Selected Answer: B

It's B. Others are wrong: A. Includes 35.100.0.0/16 in nonMasqueradeCIDRs → GKE will skip SNAT → traffic goes out via node's external IP, not Cloud NAT. C. Cloud NAT doesn't support creating “exclusion rules” for SNAT; SNAT control is done via ip-masq-agent, not NAT itself. D. nonMasqueradeCIDRs is not a setting on Cloud NAT — it’s only in the ip-masq-agent. This mixes up the config scopes.

upvoted 1 times

...

7103685

2 months, 2 weeks ago

Selected Answer: A

Correct answer is A

upvoted 1 times

...

1f01b87

3 months ago

Selected Answer: B

B is the correct answer.

upvoted 2 times

...