Google
PROFESSIONAL-CLOUD-NETWORK-ENGINEER · Question #109
You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google…
The correct answer is C. Configure the authorized networks to be the subnet ranges of the other spoke projects. If you want to access the control plane from outside VPC, you must authorize at least one address range to have access to the private endpoint. https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters
Submitted by tarun92· Apr 18, 2026Implementing network security
Question
You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?
Options
- AAdd a firewall rule that allows port 443 from the other spoke projects.
- BEnable Private Google Access on the subnet where the GKE nodes are deployed.
- CConfigure the authorized networks to be the subnet ranges of the other spoke projects.
- DDeploy a proxy in the spoke project where the GKE nodes are deployed and connect to the
How the community answered
(49 responses)- A4% (2)
- B8% (4)
- C73% (36)
- D14% (7)
Explanation
If you want to access the control plane from outside VPC, you must authorize at least one address range to have access to the private endpoint. https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters
Topics
#GKE#Authorized Networks#VPC Network Peering#Network Security
Community Discussion
No community discussion yet for this question.