As part of your organization's modernization efforts, the application teams are migrating services to GKE on Google Cloud (GKE). The GKE clusters will live in service projects. The teams have…

Question

Options

• AEnsure that the service project's GKE service account has the compute.securityAdmin,
• BEnsure that the service project's GKE service account has the compute.securityAdmin,
• CEnsure that the service project's GKE service account has the compute.networkUser IAM
• DReview the firewall rules configuration in the VPC. Identify what rule is blocking node creation.

• A
  76% (19)
• B
  4% (1)
• C
  4% (1)
• D
  16% (4)

Explanation

When using GKE in a Shared VPC environment, GKE requires elevated IAM permissions beyond what is needed for plain Compute Engine instance creation. The service project's GKE service account must have compute.securityAdmin on the host project (to manage firewall rules for node-to-control-plane communication) along with compute.networkUser (to use shared subnets) and container.hostServiceAgentUser (to interact with the host project's network resources). Since regular Compute Engine instances work but GKE cluster creation fails, the missing permissions are GKE-specific. Option C only grants compute.networkUser, which is insufficient. Option D addresses firewalls rather than IAM. Option B differs from A in a critical permission.

No community discussion yet for this question.