Exam Professional Cloud Network Engineer topic 1 question 115 discussion

B it is.

Choose B

A and D are eliminated as restricted.googleapis.com is the right URL (not private.googleapis.com) Between B and C, removing the default gateway at VPC does not help as this relates to on-premise. Instead opening a direct access to the API external IP address would enable the servers to access the API directly.

https://cloud.google.com/vpc-service-controls/docs/set-up-private-connectivity#configure-firewall

I was posting a big explanation here but the website has failed and I am very lazy to write it again, so now I'll write the sort version. The correct Answer is D. Every GKE node reserves a CIDR network for it based in the pods per node number (I suppose that for routing purposes using iptables). To calculate it, just multiply the pods per node number * 2 and select the upper closer CIDR. 8 * 2 = 16, which fits into a /28 CIDR which has exactly 16 addresses. A 10 nodes cluster will require then 160 addresses which only fits in a /24 CIDR and above, so the only answer that match is the D. The other CIDR calculation match, even the services one. It uses a /22 CIDR and like it doesn't requires to reserve the network and broadcast addresses, it match the 1024 requirement. Best regards

B is right answer

B it is, as we need to allow traffic on the firewall on-prem. As well, we have to use restricted due to compatibility