Trace the request and credential paths.

Who should normally own an application team's path rules?

Why: HTTPRoute separates application routing from the platform-owned Gateway and provider-owned GatewayClass.

Where do multi-cluster Gateway resources live?

Why: The config cluster is the single source of Gateway and HTTPRoute intent for the multi-cluster controller.

What does enabling Workload Identity Federation grant automatically?

Why: Federation creates an identity path; explicit IAM policy still grants the allowed Google Cloud actions.

Quiz 4–6: Gateway and identity

This quiz is easiest to understand by separating the Kubernetes contract from the Google Cloud implementation. Choose one answer for each question, then use Check answer to reveal the explanation. Questions mix recall, design and troubleshooting from the full deck. The Kubernetes objects stay familiar, but GKE supplies controllers, infrastructure and safe defaults around them. This is why a team can move from an on-premises cluster without rewriting every workload, while still needing to redesign networking, identity and operational ownership for the cloud environment.

A useful inspection step is `kubectl explain gateway.spec`. Read the output as evidence, not as a ritual: first confirm the desired object exists, then look at status conditions, events and the Google Cloud resource it represents. In production, capture the expected result in a runbook or automated check so an operator can distinguish slow reconciliation from a configuration error.

Production gotcha: A correct answer should be supported by a mechanism from the slides, not by brand preference. The safe habit is to verify quotas, regional availability and feature support against current Google Cloud documentation before rollout. Reset the quiz after review to test retention without prompts.