You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters. Due to IP address exhaustion of the RFC 1918 address space in your enterprise, you plan to use…

Question

Options

• ACreate the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters.
• BCreate the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters,
• CCreate privately used public IP primary and secondary subnet ranges for the clusters. Create a
• DCreate privately used public IP primary and secondary subnet ranges for the clusters. Create a

• A
  15% (2)
• B
  8% (1)
• C
  8% (1)
• D
  69% (9)

Explanation

When using privately used public IP space for GKE clusters, Google's recommended practice is to create the primary subnet and secondary ranges using those public IP blocks, then create a VPC firewall egress deny rule and a custom static route with a null next hop (blackhole route) targeting those IP ranges. This ensures that even if a packet escapes the cluster, it cannot be routed to the real public internet owners of those IPs. Without these safeguards, traffic destined for those addresses could inadvertently leave your VPC and reach unintended destinations on the internet, creating a security and connectivity risk. Options A and B use RFC 1918 space, contradicting the scenario's premise of IP exhaustion requiring public IP reuse.

No community discussion yet for this question.