Separate controls that solve different problems.

Which control evaluates whether an image may be deployed?

Why: Binary Authorization is the admission control for image policy; Shielded Nodes protects node identity and boot integrity.

HPA creates Pods that remain Pending for lack of CPU. Which loop should react next?

Why: Infrastructure scaling reacts to unschedulable Pods, provided a feasible node shape, quota and address space exist.

What is the strongest reason to choose Standard over Autopilot?

Why: Choose Standard when a concrete workload requirement needs its extra control, not as a maturity signal.

Quiz 7–9: security and scaling

This quiz is easiest to understand by separating the Kubernetes contract from the Google Cloud implementation. Choose one answer for each question, then use Check answer to reveal the explanation. Questions mix recall, design and troubleshooting from the full deck. The Kubernetes objects stay familiar, but GKE supplies controllers, infrastructure and safe defaults around them. This is why a team can move from an on-premises cluster without rewriting every workload, while still needing to redesign networking, identity and operational ownership for the cloud environment.

A useful inspection step is `kubectl explain gateway.spec`. Read the output as evidence, not as a ritual: first confirm the desired object exists, then look at status conditions, events and the Google Cloud resource it represents. In production, capture the expected result in a runbook or automated check so an operator can distinguish slow reconciliation from a configuration error.

Production gotcha: A correct answer should be supported by a mechanism from the slides, not by brand preference. The safe habit is to verify quotas, regional availability and feature support against current Google Cloud documentation before rollout. Reset the quiz after review to test retention without prompts.