Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ324

Managing operations

Your organization plans to deploy a large number of Google Kubernetes Engine (GKE) clusters for business applications across different folders and projects. You must ensure that all GKE nodes always run the latest release to reduce vulnerability risk and administrative effort. What should you do?

  • A After creating clusters, use the Google Cloud console gcloud container node-pools describe NODE_POOL_NAME --cluster=CLUSTER_NAME command. Examine the upgradeSettings and UpdateInfo output.
  • B Create a custom organization policy constraint resource.management.autoUpgrade == true with an action type of ALLOW at the organization level before deployment.
  • C Create a new node pool with the newer version for each cluster. Migrate the workload. Eliminate the outdated node pool.
  • D Manually run the Google Cloud console gcloud container clusters upgrade CLUSTER_NAME--node-pool=NODE_POOL_NAME --cluster-version VERSION command on newly created clusters regularly.
Explanation

A custom Organization Policy constraint enforced at the organization level is inherited by descendant folders and projects. An ALLOW constraint whose condition is resource.management.autoUpgrade == true permits creation only of GKE node pools with node auto-upgrade enabled, providing centralized, automatic version maintenance and security updates with minimal administrative effort.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!