Create a GKE cluster in an existing VPC accessible from on‑prem with these constraints: minimal pod/service ranges, nodes and master not internet-reachable, and kubectl from on‑prem. Which cluster configuration meets the requirements?

The correct option creates a VPC-native GKE cluster, which is essential for efficient IP utilization and network performance. Using user-managed IP ranges allows for precise control over the /24 pod and service ranges, meeting the "minimal" requirement. Enabling privateEndpoint ensures the master is not internet-reachable, as it assigns an internal IP address. Master authorized networks restrict access to the master API endpoint to specified CIDR blocks, which would include the on-prem network, allowing kubectl access. A network proxy is a common method for on-prem access to internal resources. Incorrect options: "VPC advanced routes" is not a standard GKE configuration for private clusters. "GKE-managed IP ranges" doesn't allow the explicit user control needed for minimal ranges. "GKE cluster network policy" is for controlling pod-to-pod communication, not master access or IP range management.