Professional-Cloud-Network-Engineer問題集、Google実際の試験問題

質問 1

You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services.
You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?

A. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.

B. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC- native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.

C. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.

D. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC- native cluster and specify those ranges.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 2

In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet.
What should you do?

A. Delete the system-generated subnet route and create a specific route to instance-B with a tag applied to instance-A.

B. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A.

C. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag.

D. Move instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-A's network. Configure the appropriate routes to force traffic through to instance-A.

正解: B

質問 3

You are planning to use Terraform to deploy the Google Cloud infrastructure for your company The design must meet the following requirements
* Each Google Cloud project must represent an Internal project that your team Will work on
* After an internal project is finished, the infrastructure must be deleted
* Each Internal project must have Its own Google Cloud project owner to manage the Google Cloud resources-
* You have 10-100 projects deployed at a time,
While you are writing the Terraform code, you need to ensure that the deployment IS Simple, and the code IS reusable With centralized management What should you doo

A. Create a single Shared VPC and attach each Google Cloud project as a service project

B. Create a Shared VPC and service project for each Internal project

C. Create a Single pt0Ject and additional VPCs for each Internal project

D. Create a Single Project and Single VPC for each internal project

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 4

You have a web application that is currently hosted in the us-central1 region. Users experience high latency when traveling in Asia. You've configured a network load balancer, but users have not experienced a performance improvement. You want to decrease the latency.
What should you do?

A. Configure an HTTP load balancer, and direct the traffic to it.

B. Configure a policy-based route rule to prioritize the traffic.

C. Configure Dynamic Routing for the subnet hosting the application.

D. Configure the TTL for the DNS zone to decrease the time between updates.

正解: A

質問 5

You are responsible for connectivity between AWS. Google Cloud, and an on-premises data center. Soon, the application team will deploy a data replication service that will move approximately 900 TB of data between Google Cloud and AWS daily. This data is sensitive and must be encrypted in transit. Your data center already has connections to both AWS and Google Cloud through 10 Gbps circuits. You need to configure additional connectivity between these environments and ensure the highest performance and lowest latency to meet business requirements. You also need to keep the existing connectivity topology to the on-premises data center the same. What should you do?

A. Q * Deploy Dedicated Interconnect connections between Google Cloud and your on-premises data center with 100 Gbps circuits from Google Cloud to your on-premises data center.
* Deploy an AWS Direct Connect 100 Gbps circuit from AWS to your on-premises data center.
* Create VLAN attachments in your VPC, configuring IPsec encryption on both sides of the connection.
* Use Cloud Router and BGP to exchange dynamic routes between AWS. Google Cloud, and the on- premises data center.
* Remove the obsolete 10 Gbps circuits on Google Cloud and AWS.

B. (Q) * Deploy Cross-Cloud Interconnect connections between AWS and Google Cloud with 100 Gbps circuits.
* Create VLAN attachments in your VPC, configuring IPsec encryption on both sides of the connection.
* Use Cloud Router and BGP to exchange dynamic routes between AWS and Google Cloud.

C. Q * Deploy Dedicated Interconnect connections between Google Cloud and your on-premises data center with 100 Gbps circuits.
* Deploy an AWS Direct Connect 100 Gbps circuit from AWS to your on-premises data center as well.
* Create VLAN attachments in your VPC.
* Use Cloud Router and BGP to exchange dynamic routes between AWS, Google Cloud, and the on- premises data center.
* Remove the obsolete 10 Gbps circuits on Google Cloud and AWS.

D. Q * Deploy Cross-Cloud Interconnect connections between AWS and Google Cloud with 100 Gbps circuits.
* Enable MACsec for Cloud Interconnect on the circuits, and create VLAN attachments in your VPC.
* Use Cloud Router and BGP to exchange dynamic routes between AWS and Google Cloud.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 6

Question:
Your multi-region VPC has had a long-standing HA VPN configured in "region 1" connected to your corporate network. You are planning to add two 10 Gbps Dedicated Interconnect connections and VLAN attachments in "region 2" to connect to the same corporate network. You need to plan for connectivity between your VPC and corporate network to ensure that traffic uses the Dedicated Interconnect connections as the primary path and the HA VPN as the secondary path. What should you do?

A. Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in
"region 1" to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.

B. Enable global dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in
"region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.

C. Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in
"region 1" to use a base priority value of 100. Configure BGP associated with the VLAN attachments to use a base priority of 20000. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.

D. Enable regional dynamic routing mode on the VPC. Configure BGP associated with the HA VPN in
"region 1" to use a base priority value of 20000. Configure BGP associated with the VLAN attachments to use a base priority of 100. Configure your on-premises routers to use similar multi-exit discriminator (MED) values.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 7

You recently noticed a recurring daily spike in network usage in your Google Cloud project. You need to identify the virtual machine (VM) instances and type of traffic causing the spike in traffic utilization while minimizing the cost and management overhead required. What should you do?

A. Enable VPC Flow Logs and send the output to BigQuery for analysis.

B. Deploy a third-party network appliance and configure it as the default gateway. Use the third-party network appliance to identify users with high network traffic.

C. Configure Packet Mirroring to send all traffic to a VM. Use Wireshark on the VM to identity traffic utilization for each VM in the VPC.

D. Enable Firewall Rules Logging for all allowed traffic and send the output to BigQuery for analysis.

正解: C

質問 8

You want to implement an IPSec tunnel between your on-premises network and a VPC via Cloud VPN. You need to restrict reachability over the tunnel to specific local subnets, and you do not have a device capable of speaking Border Gateway Protocol (BGP).
Which routing option should you choose?

A. Dynamic routing using Cloud Router

B. Route-based routing using default traffic selectors

C. Policy-based routing using a custom local traffic selector

D. Policy-based routing using the default local traffic selector

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 9

Question:
Your organization has distributed geographic applications with significant data volumes. You need to create a design that exposes the HTTPS workloads globally and keeps traffic costs to a minimum. What should you do?

A. Deploy a regional external Application Load Balancer with Standard Network Service Tier.

B. Deploy a regional external Application Load Balancer with Premium Network Service Tier.

C. Deploy a global external Application Load Balancer with Premium Network Service Tier.

D. Deploy a global external proxy Network Load Balancer with Standard Network Service Tier.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 10

Question:
Your organization has a new security policy that requires you to monitor all egress traffic payloads from your virtual machines in the us-west2 region. You deployed an intrusion detection system (IDS) virtual appliance in the same region to meet the new policy. You now need to integrate the IDS into the environment to monitor all egress traffic payloads from us-west2. What should you do?

A. Enable firewall logging and forward all filtered egress firewall logs to the IDS.

B. Create an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

C. Create an internal HTTP(S) load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.

D. Enable VPC Flow Logs. Create a sink in Cloud Logging to send filtered egress VPC Flow Logs to the IDS.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 11

You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?

A. Grant the read-only privilege to the service account for the Cloud Storage bucket.

B. Grant the compute.instanceAdmin to your user account.

C. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.

D. Grant the iam.serviceAccountUser to your user account.

正解: A

質問 12

You are the network administrator responsible for hybrid connectivity at your organization. Your developer team wants to use Cloud SQL in the us-west1 region in your Shared VPC. You configured a Dedicated Interconnect connection and a Cloud Router in us-west1, and the connectivity between your Shared VPC and on-premises data center is working as expected. You just created the private services access connection required for Cloud SQL using the reserved IP address range and default settings. However, your developers cannot access the Cloud SQL instance from on-premises. You want to resolve the issue. What should you do?

A. Change the VPC routing mode to global.Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.

B. Change the VPC routing mode to global.
Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.

C. Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.
Create a custom route advertisement in your Cloud Router to advertise the Cloud SQL IP address range.

D. Create an additional Cloud Router in us-west2.
Create a new Border Gateway Protocol (BGP) peering connection to your on-premises data center.
Modify the VPC Network Peering connection used for Cloud SQL, and enable the import and export of routes.

正解: C

質問 13

You are developing an HTTP API hosted on a Compute Engine virtual machine instance that must be invoked only by multiple clients within the same Virtual Private Cloud (VPC). You want clients to be able to get the IP address of the service. What should you do?

A. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url
https://[INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal/.

B. Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule. Then, define an A record in Cloud DNS. Clients should use the name of the A record to connect to the service.

C. Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule. Clients should use this IP address to connect to the service.

D. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url
https://[API_NAME]/[API_VERSION]/.

正解: B

質問 14

You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?

A. Deploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.

B. Enable Private Google Access on the subnet where the GKE nodes are deployed.

C. Add a firewall rule that allows port 443 from the other spoke projects.

D. Configure the authorized networks to be the subnet ranges of the other spoke projects.

正解: D

Google Cloud Certified - Professional Cloud Network Engineer - Professional-Cloud-Network-Engineer 模擬練習