Google PCA Designing for Security and Compliance Practice Question
A company is deploying a multi-tenant SaaS application on GKE. Each tenant's data must be isolated at the network level. They want to use a single GKE cluster but ensure that pods from different tenants cannot communicate with each other. Which GCP feature should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Kubernetes Network Policies
Kubernetes Network Policies allow you to define rules for pod-to-pod communication within a cluster, enabling tenant isolation. GKE Sandbox provides stronger isolation at the kernel level but is not specifically for network isolation. VPC Service Controls are for Google Cloud services, not pod-level. Istio can also provide network control but is a more complex mesh.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Istio service mesh
Why it's wrong here
Istio service mesh provides mutual TLS, traffic management, and observability between services, but it does not enforce network-level isolation between pods by default; its authorization policies operate at the application layer (L7) and require explicit configuration to block inter-tenant traffic, whereas the requirement demands native network-layer (L3/L4) segmentation that a GKE cluster alone cannot guarantee without a separate mechanism like GKE Network Policies or a dedicated VPC per tenant. It is tempting because Istio is often used for microsegmentation in service meshes, and in a scenario where tenants share a cluster but need L7 policy-based access control (e.g., HTTP header-based routing), Istio would be the correct choice.
- ✗
VPC Service Controls
Why it's wrong here
VPC Service Controls apply to Google Cloud services, not pod-to-pod communication.
- ✓
Kubernetes Network Policies
Why this is correct
Network Policies can restrict pod-to-pod traffic based on labels and namespaces, providing tenant isolation.
- ✗
GKE Sandbox
Why it's wrong here
GKE Sandbox uses gVisor for kernel-level isolation, not network policies.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.