Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud DevOps Engineer practice bank has 1,455 more like it. Try 10 free: instant score, no account.
An enterprise organization operates multiple Google Kubernetes Engine (GKE) clusters across separate Google Cloud projects for production and staging environments. A DevOps engineer is tasked with registering these heterogeneous clusters into a centralized fleet host project to establish unified Fleet Workload Identity for seamless, cross-cluster credential exchange and service authentication.
Which configuration requirement and architectural constraint must the engineer apply when implementing this fleet architecture?
This option proposes registering clusters within their local project fleets first and subsequently shifting them to the central fleet host project using dynamic unregistration (--clear-fleet-project) and re-registration workflows during runtime.
PROJECT_ID.svc.id.goog). Existing workloads relying on federated credentials immediately face blocked requests, authorization failures, and service outages.The organization was decommissioning an entire environment or permanently detaching a standalone cluster where active production workload availability and token stability were not required.
Because fleet identity pools are tied directly to the fleet host project ID, any change in fleet membership fundamentally alters the issuer URL and audience claims embedded inside the Kubernetes service account tokens.
This approach attempts to use lightweight memberships for fleet registration under the assumption that it reduces management overhead, while trying to supplement missing identity functionality by creating separate, manual Workload Identity pools in each spoke project.
The organization only wanted to coordinate cluster upgrade waves across multiple environments using fleet rollout sequencing while intentionally restricting clusters from accessing fleet-level services, metrics, or cross-cluster identity sharing.
DevOps engineers should use lightweight memberships only when clusters require loose organizational grouping for lifecycle maintenance and must remain strictly isolated from centralized enterprise fleet services.
This option confuses Workforce Identity Federation with Fleet Workload Identity Federation, suggesting that external human workforce identity pools and fleet team scopes should be used to manage service-to-service machine authentication across Kubernetes clusters.
principal://iam.googleapis.com/locations/global/workforcePools/... representing human operators.FLEET_PROJECT_ID.svc.id.goog representing containerized workloads.The scenario required human developers without Google Cloud accounts or Google Workspace identities to authenticate to fleet clusters via kubectl and the Connect gateway using external corporate credentials (such as Azure AD or Okta).
In Google Cloud IAM architecture, Workforce Identity governs human single sign-on (SSO), Workload Identity governs machine-to-cloud service authorization, and Fleet Workload Identity unifies machine-to-machine and machine-to-cloud authorization across multi-cluster fleets.
GKE Fleet Management provides a centralized control plane to group, manage, and govern multiple Kubernetes clusters across different Google Cloud projects, on-premises environments, and third-party clouds. Fleet Workload Identity Federation extends Google Cloud Workload Identity across all member clusters in the fleet, establishing a common identity pool (FLEET_PROJECT_ID.svc.id.goog) that allows workloads to securely authenticate against Google Cloud APIs and exchange credentials across clusters without static service account keys.
production, staging) can be explicitly registered to a centralized fleet host project using appropriate cross-project IAM permissions.Registering clusters to a central fleet host project with standard memberships is the only method that establishes unified Fleet Workload Identity Federation across project boundaries. It ensures full access to fleet-wide enterprise capabilities while avoiding the architectural limitations imposed by lightweight memberships.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated