無料2024年最新のProfessional-Cloud-Network-Engineer問題集で100%合格保証には最新の サンプル
準備Professional-Cloud-Network-Engineer問題解答無料更新には100%試験合格保証 [2024]
質問 # 28
You have an HA VPN connection with two tunnels running in active/passive mode between your Virtual Private Cloud (VPC) and on-premises network. Traffic over the connection has recently increased from 1 gigabit per second (Gbps) to 4 Gbps, and you notice that packets are being dropped. You need to configure your VPN connection to Google Cloud to support 4 Gbps. What should you do?
- A. Configure a second Cloud Router to scale bandwidth in and out of the VPC.
- B. Configure the remote autonomous system number (ASN) to 4096.
- C. Configure a second set of active/passive VPN tunnels.
- D. Configure the maximum transmission unit (MTU) to its highest supported value.
正解：C
質問 # 29
You want to create a service in GCP using IPv6.
What should you do?
- A. Configure a global load balancer with the designated IPv6 address.
- B. Configure a TCP Proxy with the designated IPv6 address.
- C. Configure an internal load balancer with the designated IPv6 address.
- D. Create the instance with the designated IPv6 address.
正解：A
解説：
https://cloud.google.com/load-balancing/docs/ipv6
質問 # 30
You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner.
What should you first?
- A. Log in to your partner's portal and request the VLAN attachment there.
- B. Run gcloud compute interconnect attachments partner update <attachment> / -- region <region> --admin-enabled.
- C. Create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.
- D. Ask your Interconnect partner to provision a physical connection to Google.
正解：D
解説：
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview?hl=En#provisioning "To provision a Partner Interconnect connection with a service provider, you start by connecting your on-premises network to a supported service provider. Work with the service provider to establish connectivity.
質問 # 31
You have the networking configuration shown in the diagram. A pair of redundant Dedicated Interconnect connections (int-Igal and int-Iga2) terminate on the same Cloud Router. The Interconnect connections terminate on two separate on-premises routers. You are advertising the same prefixes from the Border Gateway Protocol (BGP) sessions associated with the Dedicated Interconnect connections. You need to configure one connection as Active for both ingress and egress traffic. If the active Interconnect connection fails, you want the passive Interconnect connection to automatically begin routing all traffic Which two actions should you take to meet this requirement? (Choose Two)
- A. Configure the advertised route priority as 200 for the BGP session associated with the active Interconnect connection.
- B. Configure the advertised route priority as 200 for the BGP session associated with the passive Interconnect connection.
- C. Advertise a lower MED on the passive Interconnect connection from the on-premises router
- D. Advertise a lower MED on the active Interconnect connection from the on-premises router
- E. Configure the advertised route priority > 10,200 on the active Interconnect connection.
正解：A、D
解説：
This answer meets the requirement of configuring one connection as Active for both ingress and egress traffic, and enabling automatic failover to the passive connection in case of failure. The reason is:
The advertised route priority is a value that Cloud Router uses to set the route priority when advertising routes to your on-premises router. The lower the value, the higher the priority1. By setting the advertised route priority as 200 for the active connection, you ensure that it has a higher priority than the passive connection, which has the default value of 1001. This way, your on-premises router will prefer the routes from the active connection over the passive one for ingress traffic.
The MED (Multi-Exit Discriminator) is a value that your on-premises router uses to indicate its preference for receiving traffic from Cloud Router. The lower the value, the higher the preference2. By advertising a lower MED on the active connection from your on-premises router, you ensure that Cloud Router will prefer sending traffic to the active connection over the passive one for egress traffic.
If the active connection fails, Cloud Router will stop receiving routes from it and will start using the routes from the passive connection for egress traffic. Similarly, your on-premises router will stop receiving routes with priority 200 from the active connection and will start using the routes with priority 100 from the passive connection for ingress traffic. This achieves automatic failover without any manual intervention.
Option A is incorrect because setting the advertised route priority > 10,200 on the active connection would deprioritize it globally in your VPC network, which is not what you want1. Option B is incorrect because advertising a lower MED on the passive connection would make Cloud Router prefer sending traffic to it over the active one, which is not what you want2. Option D is incorrect because setting the advertised route priority as 200 for both connections would make them equally preferred by your on-premises router, which is not what you want1.
Reference:
Update the base route priority | Cloud Router | Google Cloud
Configuring BGP sessions | Cloud Router | Google Cloud
質問 # 32
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
- A. gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
- B. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE
- C. gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
- D. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
正解：C
解説：
Once you have the exported file from your other provider, you can use the gcloud dns record-sets import command to import it into your managed zone.
To import record-sets, you use the dns record-sets import command. The --zone-file-format flag tells importto expect a BIND zone formatted file. If you omit this flag, import expects a YAML- formatted records file.
https://medium.com/@prashantapaudel/gcp-certification-series-2-4-planning-and-configuring- network-resources-8045ac2cc2ac
質問 # 33
You want to create a service in GCP using IPv6.
What should you do?
- A. Configure a global load balancer with the designated IPv6 address.
- B. Configure a TCP Proxy with the designated IPv6 address.
- C. Configure an internal load balancer with the designated IPv6 address.
- D. Create the instance with the designated IPv6 address.
正解：A
質問 # 34
You want to configure load balancing for an internet-facing, standard voice-over-IP (VOIP) application.
Which type of load balancer should you use?
- A. Network load balancer
- B. Internal TCP/UDP load balancer
- C. TCP/SSL proxy load balancer
- D. HTTP(S) load balancer
正解：B
質問 # 35
You created a new VPC for your development team. You want to allow access to the resources in this VPC via SSH only.
How should you configure your firewall rules?
- A. Create a single firewall rule to allow port 3389 with priority 1000.
- B. Create a single firewall rule to allow port 22 with priority 1000.
- C. Create two firewall rules: one to block all traffic with priority 65536, and another to allow port 3389 with priority 1000.
- D. Create two firewall rules: one to block all traffic with priority 0, and another to allow port 22 with priority
1000.
正解：B
解説：
Explanation/Reference: https://geekflare.com/gcp-firewall-configuration/
質問 # 36
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
- B. Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
- C. Manually patch some of the instances, and then perform a rolling restart on the instance group.
- D. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
正解：A
解説：
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups#starting_a_canary_update
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups
質問 # 37
You are creating an instance group and need to create a new health check for HTTP(s) load balancing.
Which two methods can you use to accomplish this? (Choose two.)
- A. Create a new legacy health check using the gcloud command line tool.
- B. Create a new health check using the VPC Network section in the GCP Console.
- C. Create a new health check using the gcloud command line tool.
- D. Create a new legacy health check using the Health checks section in the GCP Console.
- E. Create a new health check, or select an existing one, when you complete the load balancer's backend configuration in the GCP Console.
正解：C、E
解説：
https://cloud.google.com/load-balancing/docs/health-checks#creating_and_modifying_health_checks
質問 # 38
Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access only from resources in your corporate public networks. What should you do?
- A. Create a VPC Service Controls perimeter for each VPC with an access context policy that allows your corporate public network IP ranges.
- B. Create a VPC Service Controls perimeter for your project with an access context policy that allows your corporate public network IP ranges.
- C. Create an access context policy that allows your VPC and corporate public network IP ranges, and then attach the policy to Cloud Storage and BigQuery.
- D. Create a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized networks.
正解：B
質問 # 39
You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
- A. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168 20.88.
Configure your on-premises firewall to accept traffic from 35.199.192.0/19 Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. - B. Create a private zone in Cloud DNS for 'corp altostrat.com' called corp-altostrat-com.
Configure DNS Server Policies and create a policy with Alternate DNS servers to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 35.199.192.0/19. - C. Create a private forwarding zone in Cloud DNS for 'corp .altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 10.204.0.0/24.
Modify the /etc/resolv conf file on your Compute Engine instances to point to 192.168.20 88 - D. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 10.204.0.0/24.
Set a custom route advertisement on the Cloud Router for 10.204.0.0/24
正解：B
解説：
Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
質問 # 40
You have setup a shared VPC and you have created three projects; Host Project, Service Project-1 and Service Project-2. You have created two subnets, subnet-1 in us-west1 and subnet-
2 in us-central1 in the Host Project. Only subnet-1 has been shared with Service Project -1 but when you go to VPC networks in Service Project-1 you also see subnet-2 which hasn't been shared with Service Project-1. Please select the correct option from below why is subnet-2 available to Service Project-1. Note Host Project is the Host Project in the shared VPC, Service Project-1 and Service project-2 are the Service Projects in the shared VPC.
- A. It is a bug in Google Cloud, please report it.
- B. The current user has Shared VPC Admin role and with Shared VPC Admin role all the networks are available.
- C. By default all subnets are available.
- D. Remove Shared Network admin role to the current user.
正解：B
解説：
Option A is the Correct choice because , if the current user has Shared VPC Admin role then all the networks in the shared VPC is the available to the user irrespective of subnet level sharing permission with the Service Projects.
Option B is Incorrect because , it is not a bug .
Option C is Incorrect because ,all the subnets would be available if the current user has Shared Admin role.
Option D is Incorrect because ,Shared Network Admin role doesn't exist.
質問 # 41
You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?
- A. Configure the authorized networks to be the subnet ranges of the other spoke projects.
- B. Deploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.
- C. Add a firewall rule that allows port 443 from the other spoke projects.
- D. Enable Private Google Access on the subnet where the GKE nodes are deployed.
正解：A
質問 # 42
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?
- A. GKE Cluster
- B. GKE Pod
- C. GKE Node
- D. GKE Ingress
正解：B
解説：
https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig
質問 # 43
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?
- A. GKE Cluster
- B. GKE Pod
- C. GKE Node
- D. GKE Ingress
正解：B
解説：
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig
質問 # 44
You want to deploy a VPN Gateway to connect your on-premises network to GCP. You are using a non BGP-capable on-premises VPN device. You want to minimize downtime and operational overhead when your network grows. The device supports only IKEv2, and you want to follow Google-recommended practices.
What should you do?
- A. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to 0.0.0.0/0.* Configure the appropriate static routes.
- B. * Create a Cloud VPN instance.* Create a route-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
- C. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel per subnet.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Create the appropriate static routes.
- D. * Create a Cloud VPN instance.* Create a policy-based VPN tunnel.* Configure the appropriate local and remote traffic selectors to match your local and remote networks.* Configure the appropriate static routes.
正解：A
質問 # 45
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with the same ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
* BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?
- A. One of the VPN sessions is configured incorrectly.
- B. A firewall is blocking the traffic across the second VPN connection.
- C. BGP sessions are not established between both on-premises routers and the Cloud Router.
- D. You do not have a load balancer to load-balance the network traffic.
正解：D
質問 # 46
Your company's security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web servers within your Virtual Private Cloud (VPC) to handle HTTP and HTTPS web traffic for TCP only. What should you do?
- A. Create an allow on match ingress firewall rule with the target tag "web-server" to allow all IP addresses for TCP port 80.
- B. Create an allow on match egress firewall rule with the target tag "web-server" to allow web server IP addresses for TCP ports 60 and 443.
- C. Create an allow on match egress firewall rule with the target tag "web-server" to allow all IP addresses for TCP port 80.
- D. Create an allow on match ingress firewall rule with the target tag "web-server" to allow all IP addresses for TCP ports 80 and 443.
正解：D
質問 # 47
You have the following private Google Kubernetes Engine (GKE) cluster deployment:
You have a virtual machine (VM) deployed in the same VPC in the subnetwork kubernetes-management with internal IP address 192.168.40 2/24 and no external IP address assigned. You need to communicate with the cluster master using kubectl. What should you do?
- A. Add the network 192.168.38.0/28 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
- B. Add the network 192.168.40.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2.
- C. Add the network 192.168.36.0/24 to the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 192.168.38.2
- D. Add an external IP address to the VM, and add this IP address in the masterAuthorizedNetworksConfig. Configure kubectl to communicate with the endpoint 35.224.37.17.
正解：B
質問 # 48
You need to enable Private Google Access for use by some subnets within your Virtual Private Cloud (VPC). Your security team set up the VPC to send all internet-bound traffic back to the on- premises data center for inspection before egressing to the internet, and is also implementing VPC Service Controls in the environment for API-level security control. You have already enabled the subnets for Private Google Access. What configuration changes should you make to enable Private Google Access while adhering to your security team's requirements?
- A. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record painting to Google's private AP address range.
Change the custom route that points the default route (0/0) to the default internet gateway as the next hop. - B. Create a private DNS zone with a CNAME record for *.googleapis.com to private.googleapis.com, with an A record pointing to Google's private API address range.
Create a custom route that points Google's private API address range to the default internet gateway as the next hop. - C. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
Change the custom route that points the default route (0/0) to the default internet gateway as the next hop. - D. Create a private DNS zone with a CNAME record for *.googleapis.com to restricted.googleapis.com, with an A record pointing to Google's restricted API address range.
Create a custom route that points Google's restricted API address range to the default internet gateway as the next hop.
正解：A
質問 # 49
......
Google Professional-Cloud-Network-Engineer認定試験は、Google Cloud Platform上でネットワークソリューションを設計および実装する候補者のスキルと知識を包括的かつ厳しい評価です。この認定試験に合格することは、クラウド上のネットワーキング技術に取り組む候補者の専門知識と能力を示し、Google Cloud Platformのネットワークニーズに対してパワーを発揮するために、組織にとって貴重な資産になります。
この試験は、複数選択と複数選択の質問、および実際の問題に知識とスキルを適用する必要があるシナリオベースの質問で構成されています。試験の合格スコアは、Googleクラウドプラットフォームで複雑なネットワークを設計および管理する能力を検証し、仲間や潜在的な雇用主にクラウドネットワーキングの専門知識を実証します。 Google Cloud Certified Professional Cloud Network Engineerとして、あなたはあなたの分野の専門家として認識され、クラウドネットワーキングに対するあなたの情熱を共有する専門家のグローバルコミュニティにアクセスできます。
リアル問題集Google Professional-Cloud-Network-Engineer試験問題 [更新されたのは2024年]：https://www.passtest.jp/Google/Professional-Cloud-Network-Engineer-shiken.html
無料Professional-Cloud-Network-Engineer試験問題集合格させるお手軽に試験合格：https://drive.google.com/open?id=107avTecFOx6DsR9nAgRPUn3Uac0wmsdQ