Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Why do many organisations put GKE clusters in service projects attached to a Shared VPC?

   1. AIt's required by GKE
   2. BThe network team owns IP plans, routes, firewalls and hybrid links centrally, while application or environment teams own their clusters in their own projects
   3. CIt's cheaper per cluster
   4. DIt disables IAM
   Show answer

   B. Shared VPC separates network administration (host project) from workload administration (service projects), with one consistent IP plan and hybrid connectivity.

   From lesson 03 · Organisation, projects & Shared VPC

2. Q2. Private nodes have no external IPs. How do they reach Artifact Registry and Cloud Logging?

   1. AThey can't
   2. BPrivate Google Access on the subnet (Google APIs) and Cloud NAT for anything on the internet
   3. CThrough the control plane
   4. DThrough a VPN only
   Show answer

   B. Private Google Access lets VMs without external IPs reach Google APIs; Cloud NAT gives outbound internet access for everything else.

   From lesson 03 · Organisation, projects & Shared VPC

3. Q3. What must the GKE service agent of the service project be granted in the host project?

   1. AOwner
   2. BThe Host Service Agent User role (and network user on the subnets)
   3. CNothing
   4. DBilling admin
   Show answer

   B. GKE in the service project manages firewall rules and uses subnets in the host project, so its service agent needs those roles there.

   From lesson 03 · Organisation, projects & Shared VPC

4. Q4. A Standard cluster uses the default 110 max Pods per node and a /20 Pod range. How many nodes fit?

   1. A4096
   2. B16
   3. C110
   4. D256
   Show answer

   B. At 110 Pods per node each node gets a /24 (256 addresses). A /20 holds 16 /24 blocks, so only 16 nodes fit, however few Pods they run.

   From lesson 04 · VPC-native networking & IP planning

5. Q5. The Pod range is exhausted. What is the least disruptive fix?

   1. ARecreate the cluster
   2. BAdd a secondary range to the subnet and use it for a new node pool (discontiguous multi-Pod CIDR), or lower max Pods per node on new pools
   3. CDelete Services
   4. DSwitch to a zonal cluster
   Show answer

   B. Additional Pod ranges can be attached to new node pools without rebuilding the cluster. The original ranges can't be resized in place.

   From lesson 04 · VPC-native networking & IP planning

6. Q6. What does Dataplane V2 give you?

   1. AA new VPC
   2. BAn eBPF data plane (based on Cilium) with built-in network policy enforcement and policy logging
   3. CFaster disks
   4. DLarger Pod ranges
   Show answer

   B. Dataplane V2 replaces kube-proxy and iptables with eBPF and enforces network policies without installing Calico.

   From lesson 04 · VPC-native networking & IP planning

7. Q7. What does 'private nodes' mean in GKE?

   1. ANodes in another project
   2. BNodes have only internal IPs; they reach the internet through Cloud NAT and Google APIs through Private Google Access
   3. CNodes can't run Pods
   4. DThe control plane is deleted
   Show answer

   B. Private nodes have no external IP addresses, which removes a large attack surface. Control-plane access is a separate decision.

   From lesson 05 · The cluster: control plane access, node pools & compute

8. Q8. Why replace the default Compute Engine service account on nodes?

   1. AIt's slower
   2. BIt usually has broad Editor permissions, so anything that reaches the node's credentials can change much of the project
   3. CIt can't pull images
   4. DIt costs money
   Show answer

   B. Use a dedicated minimal node service account (logging, monitoring, reading images) and give workloads their own identities with Workload Identity.

   From lesson 05 · The cluster: control plane access, node pools & compute

9. Q9. How do you keep ordinary workloads off a Spot node pool?

   1. AYou can't
   2. BTaint the Spot pool and add a matching toleration (plus a node selector or affinity) only to interruption-tolerant workloads
   3. CUse a zonal cluster
   4. DSet max Pods to 1
   Show answer

   B. Taints repel Pods without the toleration; node selectors or affinity attract the right Pods. GKE also labels Spot nodes with cloud.google.com/gke-spot=true.

   From lesson 05 · The cluster: control plane access, node pools & compute

10. Q10. A developer has roles/container.developer on the project. What can they do?

    1. AOnly read Pods in one namespace
    2. BCreate and change most Kubernetes objects in every namespace of every cluster in the project
    3. CNothing without RBAC
    4. DDelete the cluster
    Show answer

    B. IAM roles for GKE apply project-wide to all clusters and namespaces. For namespace scope, give a lighter IAM role (cluster viewer) and grant RBAC per namespace.

    From lesson 06 · Identity & access: IAM, RBAC and Workload Identity Federation

11. Q11. How does a pod get Google Cloud permissions with Workload Identity Federation for GKE?

    1. AFrom the node's service account
    2. BIAM roles are granted to the Kubernetes ServiceAccount's principal (or to a Google service account it impersonates), and the GKE metadata server issues tokens for it
    3. CFrom a key file in a Secret
    4. DFrom the control plane
    Show answer

    B. Tokens are short-lived and scoped to the ServiceAccount; there are no key files to leak or rotate.

    From lesson 06 · Identity & access: IAM, RBAC and Workload Identity Federation

12. Q12. Why use Google Groups for RBAC?

    1. AIt's faster
    2. BRoleBindings name groups, so access follows team membership managed in your identity system instead of per-user bindings in every cluster
    3. CIt replaces IAM
    4. DIt's required for Autopilot
    Show answer

    B. Groups must be members of a designated security group (gke-security-groups@yourdomain) for GKE to see them in RBAC.

    From lesson 06 · Identity & access: IAM, RBAC and Workload Identity Federation

13. Q13. What does a Service of type LoadBalancer create on GKE by default?

    1. AAn Application Load Balancer
    2. BA passthrough Network Load Balancer (L4) to the Service
    3. CNothing
    4. DA Cloud NAT
    Show answer

    B. Service LoadBalancer gives an L4 passthrough load balancer (external by default, internal with the internal annotation). HTTP routing needs Ingress or Gateway.

    From lesson 07 · Load balancing: Services, Ingress & Gateway API

14. Q14. What is container-native load balancing?

    1. ALoad balancing inside the container
    2. BThe load balancer sends traffic straight to Pod IPs through network endpoint groups (NEGs), instead of to node ports
    3. CA Service mesh
    4. DDNS round robin
    Show answer

    B. With NEGs, health checks and traffic go to Pods directly: better distribution, fewer hops, and readiness that the load balancer understands.

    From lesson 07 · Load balancing: Services, Ingress & Gateway API

15. Q15. Why choose the Gateway API over Ingress for a new platform?

    1. AIngress is removed
    2. BIt separates roles (platform owns Gateways, teams own Routes), supports richer routing (headers, weights) and multi-cluster gateways, and is where new GKE features land
    3. CIt's cheaper
    4. DIt needs no load balancer
    Show answer

    B. Ingress still works, but the Gateway API models shared gateways, cross-namespace routing and traffic splitting in a portable standard.

    From lesson 07 · Load balancing: Services, Ingress & Gateway API

16. Q16. What does an Artifact Registry remote repository do?

    1. ADeletes old images
    2. BActs as a pull-through cache for an upstream registry such as Docker Hub, so clusters pull through Google Cloud
    3. CBuilds images
    4. DScans for secrets
    Show answer

    B. Remote repositories cache upstream images: fewer public-registry rate limits, private nodes need no internet, and you control what's pulled.

    From lesson 08 · Artifact Registry & application delivery

17. Q17. How should a GitHub Actions workflow authenticate to push images?

    1. AA JSON key in a repository secret
    2. BWorkload Identity Federation: the workflow's OIDC token is exchanged for short-lived Google credentials
    3. CA personal password
    4. DAnonymous push
    Show answer

    B. No long-lived key to leak or rotate; the pool provider can restrict which repository and branch may get credentials.

    From lesson 08 · Artifact Registry & application delivery

18. Q18. What does image streaming change?

    1. AImage size
    2. BPods start before the whole image is downloaded, because data is streamed on demand from Artifact Registry
    3. CImage security
    4. DTag names
    Show answer

    B. Image streaming reads image data lazily from Artifact Registry, which shortens start-up for large images, especially when scaling.

    From lesson 08 · Artifact Registry & application delivery

19. Q19. A zonal Persistent Disk is in europe-west1-b, and that zone fails. What happens to the Pod using it?

    1. AIt moves to another zone with its data
    2. BIt can't start elsewhere until the zone is back, because a zonal disk only attaches in its zone
    3. CThe disk is copied automatically
    4. DNothing, zones never fail
    Show answer

    B. Zonal disks are tied to one zone. Regional Persistent Disks (replicated across two zones) or app-level replication let the Pod restart in another zone.

    From lesson 09 · Storage: Persistent Disk, Hyperdisk, Filestore & Cloud Storage

20. Q20. Why do GKE's default StorageClasses use volumeBindingMode WaitForFirstConsumer?

    1. ATo save money
    2. BSo the disk is created in the zone where the Pod is scheduled, instead of a random zone the Pod then can't use
    3. CTo encrypt the disk
    4. DIt's required for Filestore
    Show answer

    B. Binding waits until the scheduler picks a node, so the disk lands in that node's zone.

    From lesson 09 · Storage: Persistent Disk, Hyperdisk, Filestore & Cloud Storage

21. Q21. Which storage gives ReadWriteMany to Pods on many nodes?

    1. Apd-balanced
    2. BFilestore (NFS) through its CSI driver
    3. CHyperdisk Extreme
    4. DemptyDir
    Show answer

    B. Persistent Disk is ReadWriteOnce (one node writes). Filestore is managed NFS and supports ReadWriteMany.

    From lesson 09 · Storage: Persistent Disk, Hyperdisk, Filestore & Cloud Storage

22. Q22. What triggers the cluster autoscaler to add a node?

    1. AHigh CPU usage on nodes
    2. BPods that can't be scheduled because no node has room for their requests
    3. CA cron schedule
    4. DMemory leaks
    Show answer

    B. The autoscaler works on requests and pending Pods, not on live usage. Wrong requests mean wrong scaling.

    From lesson 10 · Autoscaling: Pods, nodes and compute classes

23. Q23. What does node auto-provisioning add on top of the cluster autoscaler?

    1. ANothing
    2. BIt creates and deletes whole node pools with suitable machine types for pending Pods, within cluster-wide resource limits
    3. CIt scales Pods
    4. DIt upgrades nodes
    Show answer

    B. The cluster autoscaler only resizes existing pools. Auto-provisioning (and compute classes) also chooses machine shapes.

    From lesson 10 · Autoscaling: Pods, nodes and compute classes

24. Q24. Why should you be careful running the HPA and the VPA on the same metric?

    1. AThey don't install together
    2. BBoth react to CPU, so the VPA changing requests moves the HPA's utilisation target and the two fight
    3. CThe VPA is deprecated
    4. DIt costs more
    Show answer

    B. Use the HPA on CPU (or custom metrics) and the VPA for memory or in recommendation mode, or GKE's multidimensional Pod autoscaling which combines them deliberately.

    From lesson 10 · Autoscaling: Pods, nodes and compute classes