GCP Associate Cloud Engineer Practice Question

Your security team mandates that application nodes must not have public IP addresses. The platform team also wants an SLA that survives the loss of a single zone, while eliminating all node-level maintenance tasks and shifting to a pay-per-pod pricing model. Which Google Kubernetes Engine deployment best satisfies all of these requirements?

Create a zonal Autopilot private cluster.
Create a regional Autopilot private cluster.
Create a regional Standard private cluster with node auto-repair enabled.
Create a regional Standard public cluster and enable node auto-upgrade.

Report Issue

Answer Description

A regional Autopilot private cluster meets every stated need:

Autopilot clusters give Google full responsibility for provisioning, patching, and scaling nodes, so there are no node-level maintenance tasks and billing is based on the CPU/memory requested by running Pods.
Autopilot supports creating private clusters in which worker nodes have only internal IP addresses, satisfying the security mandate.
Choosing a regional control plane replicates masters and nodes across at least two zones in the region, allowing the cluster to withstand a single-zone outage.

The other options fail at least one requirement:

A zonal private Autopilot cluster cannot tolerate a zone failure.
A regional standard private cluster still requires the customer to manage and patch nodes and is billed per node.
A regional standard public cluster does not meet the private-node security requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.