Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Google Cloud Certified Professional Cloud Security Engineer · Google Cloud
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The only way to stop a pod to be scheduled on a node is using taint.
Taints and Tolerations are used in Kubernetes to control which Pods can be scheduled on which Nodes. By applying a taint to Nodes labeled as inscope: true with the effect NoSchedule, you ensure that only Pods that can tolerate this taint can be scheduled on these Nodes. Then, by configuring the in-scope Pods with a matching toleration, you guarantee that only these Pods will land on the Nodes marked as in-scope. This method ensures both that only in-scope Pods run on these Nodes and that these Nodes are used exclusively for in-scope Pods, meeting the compliance requirement.
Using a node selector does not prevent other pods from being scheduled in the pci-scope nodes. However a taint and toleration would ensure that only the pods with the toleration can be scheduled in the pci-scope nodes.