You are restricting an etcd cluster so that only the API servers may talk to it. Which two etcd settings accomplish that? Choose two.

Answer: A. --client-cert-auth=true
C. --trusted-ca-file

Together these make etcd verify client certificates against a named CA, so only holders of a certificate from that CA get in. The peer flags secure member-to-member traffic and the advertise URL is addressing.

Source: Operating etcd clusters for Kubernetes (Kubernetes) — Securing etcd clusters › Limiting access of etcd clusters