[2024年08月]更新のGoogle Professional-Cloud-Network-Engineer問題集とリアルな試験問題
2024年最新のProfessional-Cloud-Network-EngineerのPDF最近更新された問題
質問 # 25
You are planning a large application deployment in Google Cloud that includes on-premises connectivity. The application requires direct connectivity between workloads in all regions and on-premises locations without address translation, but all RFC 1918 ranges are already in use in the on-premises locations. What should you do?
- A. Use non-RFC 1918 ranges with a single global VPC.
- B. Use overlapping RFC 1918 ranges with multiple isolated VPC networks and Cloud NAT.
- C. Use multiple VPC networks with a transit network using VPC Network Peering.
- D. Use overlapping RFC 1918 ranges with multiple isolated VPC networks.
正解：A
質問 # 26
You have installed Apache Tomcat 8.X on a compute engine in google cloud on port 8085 and you have also installed Jenkins on the same machine on a custom port .You have created a firewall rule that allows traffic to port 8085 .You can see the Apache Tomcat page when you browse X.X.X.X:8085 , but when you browse X.X.X.X:custom port , the Jenkins page doesn't load . What could be the possible solution? Please select the right choice.
- A. Create a firewall rule; select the correct subnet which has the compute engine and allow all protocols and ports .
- B. Create a firewall rule; select the correct network , create a target tag and attach the tag to the compute engine instance and allow traffic to custom port that is mapped with Jenkins.
- C. Create a firewall rule; select the correct subnet , create a target tag attach it to the compute engine instance and allow all protocols and ports.
- D. Create a firewall rule; select the correct network and select the target as all instances in the network and specify the custom port and protocol.
正解：B
解説：
Option B is the Correct choice because, creating a tag and attaching it to the compute engine instance and also allowing traffic to custom port is is less permissive.
Option A is Incorrect because , selecting the target as all instances in the network allows traffic to all instances .
Option C is Incorrect because allowing all protocols and ports is a security scare and always follow principle of least permissive.
Option D is Incorrect because, allowing all protocols and ports could lead to a security disaster, always follow the principle of least permissive.
質問 # 27
You created a new VPC for your development team. You want to allow access to the resources in this VPC via SSH only.
How should you configure your firewall rules?
- A. Create two firewall rules: one to block all traffic with priority 65536, and another to allow port 3389 with priority 1000.
- B. Create a single firewall rule to allow port 3389 with priority 1000.
- C. Create two firewall rules: one to block all traffic with priority 0, and another to allow port 22 with priority 1000.
- D. Create a single firewall rule to allow port 22 with priority 1000.
正解：D
質問 # 28
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?
- A. Security Admin privileges from the Shared VPC Admin.
- B. Shared VPC Admin privileges from the Organization Admin.
- C. Service Project Admin privileges from the Shared VPC Admin.
- D. Organization Admin privileges from the Organization Admin.
正解：A
解説：
Explanation/Reference: https://cloud.google.com/vpc/docs/shared-vpc
質問 # 29
You configured Cloud VPN with dynamic routing via Border Gateway Protocol (BGP). You added a custom route to advertise a network that is reachable over the VPN tunnel. However, the on-premises clients still cannot reach the network over the VPN tunnel. You need to examine the logs in Cloud Logging to confirm that the appropriate routers are being advertised over the VPN tunnel. Which filter should you use in Cloud Logging to examine the logs?
- A. resource.type= "vpn_tunnel"
- B. resource.type= "gce_router"
- C. resource.type= "gce_network_region"
- D. resource.type= "vpn_gateway"
正解：A
質問 # 30
Your organization requires that metrics from all applications be retained for 5 years for future analysis in possible legal proceedings. Which approach should you use?
- A. Grant the security team access to the logs in each Project.
- B. Configure Stackdriver Monitoring for all Projects, and export to BigQuery.
- C. Configure Stackdriver Monitoring for all Projects, and export to Google Cloud Storage.
- D. Configure Stackdriver Monitoring for all Projects with the default retention policies.
正解：C
解説：
B and D can be quickly ruled out because none of them is good solution for the requirements
"retained for 5 years"
Between A and C, the different is where to store, BigQuery or Cloud Storage. Since the main concern is extended storing period, C (Correct Answer) is better answer, and the "retained for 5 years for future analysis" further qualifies it, for example, using Coldline storage class.
With regards of BigQuery, while it is also a low-cost storage, but the main purpose is for analysis.
Also, logs in Cloud Storage is easy to transport to BigQuery whenever needed.
質問 # 31
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?
- A. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services.
Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets. - B. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
- C. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.
- D. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services.
Create a VPC-native cluster and specify those ranges.
正解：A
解説：
https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters
質問 # 32
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
- Each on-premises router is configured with a unique ASN. ?Each on-
premises router is configured with the same routes and priorities.
- Both on-premises routers are configured with a VPN connected to a
single Cloud Router.
- BGP sessions are established between both on-premises routers and the Cloud Router.
- Only 1 of the on-premises router's routes are being added to the
routing table.
What is the most likely cause of this problem?
- A. The on-premises routers are configured with the same routes.
- B. A firewall is blocking the traffic across the second VPN connection.
- C. The ASNs being used on the on-premises routers are different.
- D. You do not have a load balancer to load-balance the network traffic.
正解：D
質問 # 33
You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner.
What should you first?
- A. Run gcloud compute interconnect attachments partner update <attachment> / -- region <region> --admin-enabled.
- B. Create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.
- C. Log in to your partner's portal and request the VLAN attachment there.
- D. Ask your Interconnect partner to provision a physical connection to Google.
正解：D
解説：
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview?hl=En#provisioning "To provision a Partner Interconnect connection with a service provider, you start by connecting your on-premises network to a supported service provider. Work with the service provider to establish connectivity.
質問 # 34
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?
- A. Use gcloud container clusters create [CLUSTER NAME]to create a VPC-native cluster.
- B. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC- native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
- C. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC- native cluster and specify those ranges.
- D. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-aliasto create a VPC-native cluster.
正解：B
解説：
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters
質問 # 35
A database virtual machine on Google Compute Engine has an ext4-formatted persistent disk for data files. The database is about to run out of storage space How can you remediate the problem with the least amount of downtime?
- A. In the Cloud Platform Console, increase the size of the persistent disk and use the resize2fs command in Linux.
- B. In the Cloud Platform Console, create a snapshot of the persistent disk, restore the snapshot to a new larger disk, unmount the old disk, mount the new disk, and restart the database service.
- C. Shut down the virtual machine, use the Cloud Platform Console to increase the persistent disk size, then restart the virtual machine.
- D. In the Cloud Platform Console, create a new persistent disk attached to the virtual machine, format and mount it, and configure the database service to move the files to the new disk.
- E. In the Cloud Platform Console, increase the size of the persistent disk and verify the new space is ready to use with the fdisk command in Linux.
正解：A
解説：
A (Correct answer) - In the Cloud Platform Console, increase the size of the persistent disk and use the resize2fs command in Linux.
Here are the steps: In the Cloud Platform Console, increase the size of the persistent disk; after indicating size increase in console, to make the new size effective, you have two options: restart the VM or configure in the VM's operating systems, Windows or Linux.
質問 # 36
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
- B. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- C. Add a second on-premises VPN gateway with a different public IP address. Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP.
- D. Add a second Cloud VPN gateway in a different region than the existing VPN gateway. Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address.
正解：C
解説：
https://cloud.google.com/network-connectivity/docs/vpn/concepts/classic-topologies#redundancy-options
質問 # 37
You are maintaining a Shared VPC in a host project. Several departments within your company have infrastructure in different service projects attached to the Shared VPC and use Identity and Access Management (IAM) permissions to manage the cloud resources in those projects. VPC Network Peering is also set up between the Shared VPC and a common services VPC that is not in a service project. Several users are experiencing failed connectivity between certain instances in different Shared VPC service projects and between certain instances and the internet. You need to validate the network configuration to identify whether a misconfiguration is the root cause of the problem. What should you do?
- A. Run Connectivity Tests from Network Intelligence Center to check connectivity between the affected endpoints in your network and the internet.
- B. Enable VPC Flow Logs for all VPCs, and review the logs in Cloud Logging for the affected instances.
- C. Review the VPC audit logs in Cloud Logging for the affected instances.
- D. Use Secure Shell (SSH) to connect to the affected Compute Engine instances, and run a series of PING tests to the other affected endpoints and the 8.8.8.8 IPv4 address.
正解：A
質問 # 38
You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network Currently, there Is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability What should you do?
- A. Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
- B. Use HA VPN. Configure one tunnel from each Interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.
- C. Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
- D. Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
正解：D
質問 # 39
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from on-premises locations using Cloud Interconnect connections. Your company must be able to send traffic to Cloud Storage only through the Interconnect links while accessing other Google APIs and services over the public internet. What should you do?
- A. Use the default public domains for all Google APIs and services.
- B. Use Private Google Access, with restricted.googleapis.com virtual IP addresses for Cloud Storage and private.googleapis.com for all other Google APIs and services.
- C. Use Private Google Access, with private.googleapis.com virtual IP addresses for Cloud Storage and restricted.googleapis.com virtual IP addresses for all other Google APIs and services.
- D. Use Private Service Connect to access Cloud Storage, and use the default public domains for all other Google APIs and services.
正解：D
質問 # 40
You need to establish network connectivity between three Virtual Private Cloud networks, Sales, Marketing, and Finance, so that users can access resources in all three VPCs. You configure VPC peering between the Sales VPC and the Finance VPC. You also configure VPC peering between the Marketing VPC and the Finance VPC. After you complete the configuration, some users cannot connect to resources in the Sales VPC and the Marketing VPC. You want to resolve the problem.
What should you do?
- A. Alter the routing table to resolve the asymmetric route.
- B. Configure VPC peering in a full mesh.
- C. Delete the legacy network and recreate it to allow transitive peering.
- D. Create network tags to allow connectivity between all three VPCs.
正解：B
質問 # 41
You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby.
Which BGP attribute should you use on your on-premises router?
- A. Community
- B. AS-Path
- C. Local Preference
- D. Multi-exit Discriminator
正解：D
質問 # 42
......
最新のProfessional-Cloud-Network-Engineer合格保証される試験問題集認証サンプル問題：https://www.passtest.jp/Google/Professional-Cloud-Network-Engineer-shiken.html
Professional-Cloud-Network-Engineer試験合格保証最新172問題：https://drive.google.com/open?id=11U_xZeWP3cra1WzXjV4cb3oqyeSESzsF