PCNE Configuring Network Services Practice Question

A company runs a private GKE cluster in us-central1. Pods need to access the internet for updates. Which configuration is required?

⚠ Common exam trap

Google Cloud often tests the misconception that private clusters can reach the internet via default routes or firewall rules alone, but the trap here is that without Cloud NAT or a public IP, private instances have no path to the internet because the VPC's default route only covers internal ranges.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable Cloud NAT on the cluster's subnet.

In a private GKE cluster, nodes do not have external IPs, so pods cannot reach the internet directly. Cloud NAT provides outbound connectivity by translating private IPs to a public IP, allowing pods to fetch updates while keeping the cluster private. This is the standard solution for outbound-only internet access from private GKE clusters.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add network tags to allow egress traffic.
Why it's wrong here
Network tags help with firewall rules but do not provide NAT.
✗
Create a Cloud Router with BGP peering.
Why it's wrong here
Cloud Router is for dynamic routing, not NAT.
✓
Enable Cloud NAT on the cluster's subnet.
Why this is correct
Cloud NAT provides outbound internet access for private instances.
✗
Assign external IPs to the nodes.
Why it's wrong here
External IPs defeat the purpose of a private cluster and are not recommended.

Visual reference

Go deeper

PCNE Configuring Network Services Practice Question

Why each option matters

Option-by-option breakdown

Related to this question