Courseiva
← ACE
Full test
hardMultiple ChoiceObjective-mapped

Google ACE Practice Question: A GKE cluster hosts multiple teams' workloads in…

A GKE cluster hosts multiple teams' workloads in separate namespaces. One team's pods should not be able to make API calls to Google Cloud services (e.g., they should not call BigQuery or Cloud Storage). The pods currently use the node's service account via the Compute Engine metadata server. How do you restrict these specific pods from accessing GCP APIs while allowing other pods on the same node to continue using GCP APIs?

⚠ Common exam trap

Google Cloud often tests the misconception that `automountServiceAccountToken: false` blocks all cloud API access, but it only affects the Kubernetes API token, not the Compute Engine metadata server which provides cloud credentials.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Apply a Kubernetes NetworkPolicy in the team's namespace blocking egress to `169.254.169.254` (the metadata server).

The Compute Engine metadata server (169.254.169.254) is the endpoint that provides the node's service account credentials to pods. By applying a Kubernetes NetworkPolicy that blocks egress to this IP in the team's namespace, you prevent those pods from reaching the metadata server, thus denying them access to GCP APIs. Other pods on the same node are unaffected because NetworkPolicy is namespace-scoped and does not apply to them.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Apply a Kubernetes NetworkPolicy in the team's namespace blocking egress to `169.254.169.254` (the metadata server).

    Why this is correct

    This is correct. A Kubernetes NetworkPolicy with an egress rule denying traffic to 169.254.169.254 blocks pods in the namespace from reaching the metadata server. Since GCP credentials for the node's service account are obtained from that server's token endpoint, the pods cannot retrieve GCP API access tokens. Other namespaces without this NetworkPolicy remain unaffected, satisfying the restriction requirement.

  • ✗

    Revoke all IAM roles from the node's service account.

    Why it's wrong here

    Revoking IAM roles from the node's service account would remove permissions from all pods running on that node, including unrelated workloads. Moreover, GKE system components rely on that service account for essential operations such as image pulling, logging, and node management, so this could break cluster functionality. It is a blunt, cluster-wide change rather than a namespace-scoped control, affecting the restricted team's pods only incidentally.

  • ✗

    Set `automountServiceAccountToken: false` on the restricted team's pods.

    Why it's wrong here

    Setting automountServiceAccountToken: false prevents the Kubernetes service account token from being mounted into the pod. This only blocks authentication to the Kubernetes API server using the pod's own service account. It does nothing to block the pod from reaching the GCP metadata server (169.254.169.254) to obtain OAuth tokens for the node's service account, so the pod retains GCP API access. Therefore this is insufficient.

  • ✗

    Use a Kubernetes ResourceQuota to limit the team's namespace API access.

    Why it's wrong here

    A Kubernetes ResourceQuota constrains aggregate resource consumption in a namespace, such as CPU, memory, persistent volume claims, or object counts. It does not govern network egress to external IPs, nor does it affect IAM or GCP API authorization. Thus it cannot prevent pods from contacting the metadata server at 169.254.169.254.

About these practice questions

One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.