• ホーム
  • ブログ
  • [2024年11月12日] 有効なProfessional-Cloud-Network-Engineerテスト解答とGoogle Professional-Cloud-Network-Engineer試験PDF問題を試そう [Q41-Q63]

[2024年11月12日] 有効なProfessional-Cloud-Network-Engineerテスト解答とGoogle Professional-Cloud-Network-Engineer試験PDF問題を試そう [Q41-Q63]

Share

[2024年11月12日] 有効なProfessional-Cloud-Network-Engineerテスト解答とGoogle Professional-Cloud-Network-Engineer試験PDF問題を試そう

実際に出るProfessional-Cloud-Network-Engineer試験問題集には正確で更新された問題


Google Professional-Cloud-Network-Engineer認定を獲得するには、候補者は200ドルの2時間の50質問の試験に合格する必要があります。試験は複数の言語で利用でき、オンラインまたはテストセンターで撮影できます。候補者はまた、Google Cloudプラットフォームで実践的な経験を持ち、ネットワークテクノロジーと概念に精通している必要があります。認定は2年間有効であり、試験の更新バージョンに合格するか、Google Cloudが提供する専門開発コースを完了することで更新できます。

 

質問 # 41
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?

  • A. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
  • B. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
  • C. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
  • D. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.

正解：B

解説：
VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet.
Reference: https://cloud.google.com/vpc/docs/vpc-peering


質問 # 42
Your company's Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure:
/fr/video
/en/video
/es/video
/../video
/fr/audio
/en/audio
/es/audio
/../audio
Which solution should you recommend?

  • A. Rearrange the directory structure, create a URL map and leverage a path rule such as /video/* and /audio/*.
  • B. Rearrange the directory structure, create DNS hostname entries for video and audio and leverage a path rule such as /video/* and /audio/*.
  • C. Leave the directory structure as-is, create a URL map and leverage a path rule such as \/[a-z]{2}\/video and
    \/[a-z]{2}\/audio.
  • D. Leave the directory structure as-is, create a URL map and leverage a path rule such as /*/video and /*/ audio.

正解：A

解説：
https://cloud.google.com/load-balancing/docs/url-map#configuring_url_maps Path matcher constraints Path matchers and path rules have the following constraints: A path rule can only include a wildcard character (*) after a forward slash character (/). For example, /videos/* and /videos/hd/* are valid for path rules, but /videos* and /videos/hd* are not. Path rules do not use regular expression or substring matching. For example, path rules for either /videos/hd or /videos/hd/* do not apply to a URL with the path /video/hd-abcd. However, a path rule for /video/* does apply to that path. https://cloud.google.com/load-balancing/docs/url-map-concepts#pm-constraints


質問 # 43
Your company has 10 separate Virtual Private Cloud (VPC) networks, with one VPC per project in a single region in Google Cloud. Your security team requires each VPC network to have private connectivity to the main on-premises location via a Partner Interconnect connection in the same region. To optimize cost and operations, the same connectivity must be shared with all projects. You must ensure that all traffic between different projects, on-premises locations, and the internet can be inspected using the same third-party appliances. What should you do?

  • A. Configure the third-party appliances with multiple interfaces and specific Partner Interconnect VLAN attachments per project. Create the relevant routes on the third-party appliances and VPC networks.
  • B. Configure the third-party appliances with multiple interfaces, with each interface connected to a separate VPC network. Create separate VPC networks for on- premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks.
  • C. Consolidate all existing projects' subnetworks into a single VPC. Create separate VPC networks for on-premises and internet connectivity. Configure the third-party appliances with multiple interfaces, with each interface connected to a separate VPC network. Create the relevant routes on the third-party appliances and VPC networks.
  • D. Configure the third-party appliances with multiple interfaces. Create a hub VPC network for all projects, and create separate VPC networks for on-premises and internet connectivity. Create the relevant routes on the third-party appliances and VPC networks. Use VPC Network Peering to connect all projects' VPC networks to the hub VPC. Export custom routes from the hub VPC and import on all projects' VPC networks.

正解：D


質問 # 44
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with the same ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
* BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?

  • A. You do not have a load balancer to load-balance the network traffic.
  • B. BGP sessions are not established between both on-premises routers and the Cloud Router.
  • C. A firewall is blocking the traffic across the second VPN connection.
  • D. One of the VPN sessions is configured incorrectly.

正解：A


質問 # 45
You want to create a service in GCP using IPv6.
What should you do?

  • A. Configure a global load balancer with the designated IPv6 address.
  • B. Create the instance with the designated IPv6 address.
  • C. Configure a TCP Proxy with the designated IPv6 address.
  • D. Configure an internal load balancer with the designated IPv6 address.

正解：A


質問 # 46
You create multiple Compute Engine virtual machine instances to be used at TFTP servers.
Which type of load balancer should you use?

  • A. Network load balancer
  • B. HTTP(S) load balancer
  • C. SSL proxy load balancer
  • D. TCP proxy load balancer

正解：C


質問 # 47
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with a unique ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* BGP sessions are established between both on-premises routers and the Cloud Router.
* Only 1 of the on-premises router's routes are being added to the routing table.
What is the most likely cause of this problem?

  • A. You do not have a load balancer to load-balance the network traffic.
  • B. The ASNs being used on the on-premises routers are different.
  • C. The on-premises routers are configured with the same routes.
  • D. A firewall is blocking the traffic across the second VPN connection.

正解：A


質問 # 48
Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client IP address. You want to identify this actor while minimizing disruption to your legitimate users.
What should you do?

  • A. Create a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.
  • B. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to disabled, and review necessary logs.
  • C. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to enabled, and review necessary logs.
  • D. Create a Cloud Armor Policy rule that denies traffic and review necessary logs.

正解：A

解説：
https://cloud.google.com/armor/docs/security-policy-concepts#preview_mode


質問 # 49
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?

  • A. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
  • B. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
  • C. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
  • D. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.

正解：C


質問 # 50
You are creating an instance group and need to create a new health check for HTTP(s) load balancing.
Which two methods can you use to accomplish this? (Choose two.)

  • A. Create a new health check, or select an existing one, when you complete the load balancer's backend configuration in the GCP Console.
  • B. Create a new legacy health check using the gcloud command line tool.
  • C. Create a new legacy health check using the Health checks section in the GCP Console.
  • D. Create a new health check using the VPC Network section in the GCP Console.
  • E. Create a new health check using the gcloud command line tool.

正解：C、E

解説：
Reference:
https://cloud.google.com/load-balancing/docs/health-checks


質問 # 51
Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node Which Pod per node CIDR range should you use?

  • A. /24
  • B. /25
  • C. /28
  • D. /26

正解：B

解説：
To determine the Pod per node CIDR range, you need to calculate how many IP addresses are required for each node, and then choose the smallest CIDR range that can accommodate that number. A CIDR range of /n means that there are 2^(32-n) IP addresses available in that range. For example, a /24 range has 2^(32-24) = 256 IP addresses.
According to the question, the application team requires a minimum of 60 Pods per node and a maximum of 100 Pods per node. Therefore, you need to choose a CIDR range that can provide at least 100 IP addresses per node, but not more than necessary. A /25 range has 2^(32-25) = 128 IP addresses, which is enough for 100 Pods per node. A /26 range has 2^(32-26) = 64 IP addresses, which is not enough for 60 Pods per node. A /24 range has 256 IP addresses, which is more than needed and wastes IP address space. A /28 range has 2^(32-28) = 16 IP addresses, which is far too small for any node.
Therefore, the best option is B. /25. This is also consistent with the Google Kubernetes Engine documentation, which states that each node is allocated a /24 range of IP addresses for Pods by default, but the maximum number of Pods per node is 1101. This means that there are approximately twice as many available IP addresses as possible Pods, which is similar to the ratio of 128 to 100 in the /25 range.
1: Configure maximum Pods per node | Google Kubernetes Engine (GKE) | Google Cloud


質問 # 52
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with on-premises connectivity already in place. You are deploying a new application using Google Kubernetes Engine (GKE), which must be accessible only from the same VPC network and on-premises locations. You must ensure that the GKE control plane is exposed to a predefined list of on-premises subnets through private connectivity only. What should you do?

  • A. Create a GKE private cluster with a private endpoint for the control plane. Configure authorized networks to specify the desired on-premises subnets.
  • B. Create a GKE public cluster. Configure authorized networks to specify the desired on-premises subnets.
  • C. Create a GKE private cluster with a private endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.
  • D. Create a GKE private cluster with a public endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers.

正解：A


質問 # 53
You have the networking configuration shown In the diagram Two VLAN attachments associated With two Dedicated Interconnect connections terminate on the same Cloud Router (mycloudrouter). The Interconnect connections terminate on two separate on-premises routers. You advertise the same prefixes from the Border Gateway Protocol (BOP) sessions associated With each Of the VLAN attachments.
You notice an asymmetric traffic flow between the two Interconnect connections. Which of the following actions should you take to troubleshoot the asymmetric traffic flow?

  • A. From the Google Cloud console, navigate to the Hybrid Connectivity select the Cloud Router, and view BGP sessions.
  • B. From the Cloud CLI. run gcloud compute routers describe mycloudrouter
  • C. From the Google Cloud console, navigate to Cloud Logging to view VPC Flow Logs and review the results
  • D. From the Cloud CLI, run gcloud compute -protect_ID router get-status mycloudrouter --region REGION and review the results.

正解：D

解説：
--region REGION and review the results
Explanation:
The correct answer is B. From the Cloud CLI, run gcloud compute --project_ID router get-status mycloudrouter --region REGION and review the results.
This command will show you the BGP session status, the advertised and learned routes, and the last error for each VLAN attachment. You can use this information to troubleshoot the asymmetric traffic flow and identify any issues with the BGP configuration or the Interconnect connections.
The other options are not correct because:
Option A will only show you the BGP session status, but not the advertised and learned routes or the last error for each VLAN attachment.
Option C will only show you the VPC Flow Logs, which are useful for monitoring and troubleshooting network performance and security issues within your VPC network, but not for your Interconnect connections.
Option D will only show you the basic information about the Cloud Router, such as its name, region, network, and BGP settings, but not the detailed status of each VLAN attachment.


質問 # 54
Your organization has Compute Engine instances in us-east1, us-west2, and us-central1. Your organization also has an existing Cloud Interconnect physical connection in the East Coast of the United States with a single VLAN attachment and Cloud Router in us-east1. You need to provide a design with high availability and ensure that if a region goes down, you still have access to all your other Virtual Private Cloud (VPC) subnets. You need to accomplish this in the most cost-effective manner possible. What should you do?

  • A. Configure your VPC routing in regional mode.
    Add additional Cloud Interconnect VLAN attachments in the us-west2 and us-central1 regions, and configure Cloud Routers in us-west2 and us-central1.
  • B. Configure your VPC routing in global mode.
    Add an additional Cloud Interconnect VLAN attachment in the us-east1 region, and configure a Cloud Router in us-east1.
  • C. Configure your VPC routing in global mode.
    Add an additional Cloud Interconnect VLAN attachment in the us-west2 region, and configure a Cloud Router in us-west2.
  • D. Configure your VPC routing in regional mode.
    Add an additional Cloud Interconnect VLAN attachment in the us-east1 region, and configure a Cloud Router in us-east1.

正解：B


質問 # 55
You work for a university that is migrating to GCP.
These are the cloud requirements:
* On-premises connectivity with 10 Gbps
* Lowest latency access to the cloud
* Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost- efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?

  • A. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
  • B. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
  • C. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
  • D. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.

正解：C


質問 # 56
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection.
Which two actions can accomplish this? (Choose two.)

  • A. Open a Cloud Support ticket under the Cloud Interconnect category.
  • B. Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
  • C. Run gcloud compute interconnects describe <interconnect>.
  • D. Check the email for the account of the NOC contact that you specified during the ordering process.
  • E. Contact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.

正解：D、E

解説：
https://cloud.google.com/network-connectivity/docs/interconnect/how-to/dedicated/retrieving-loas


質問 # 57
Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers. The migration to GCP will be lift-and-shift, and all requests to the servers will be served by a single network load balancer frontend. You want to use a GCP-native solution when possible.
How should you deploy this service in GCP?

  • A. Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.
  • B. Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.
  • C. Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.
  • D. Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal-priority static routes to the backend servers.

正解：A


質問 # 58
You have setup a shared VPC and you have created three projects; Host Project, Service Project-1 and Service Project-2. You have created two subnets, subnet-1 in us-west1 and subnet-
2 in us-central1 in the Host Project. Only subnet-1 has been shared with Service Project -1 but when you go to VPC networks in Service Project-1 you also see subnet-2 which hasn't been shared with Service Project-1. Please select the correct option from below why is subnet-2 available to Service Project-1. Note Host Project is the Host Project in the shared VPC, Service Project-1 and Service project-2 are the Service Projects in the shared VPC.

  • A. By default all subnets are available.
  • B. Remove Shared Network admin role to the current user.
  • C. It is a bug in Google Cloud, please report it.
  • D. The current user has Shared VPC Admin role and with Shared VPC Admin role all the networks are available.

正解：D

解説：
Option A is the Correct choice because , if the current user has Shared VPC Admin role then all the networks in the shared VPC is the available to the user irrespective of subnet level sharing permission with the Service Projects.
Option B is Incorrect because , it is not a bug .
Option C is Incorrect because ,all the subnets would be available if the current user has Shared Admin role.
Option D is Incorrect because ,Shared Network Admin role doesn't exist.


質問 # 59
You want to create a service in GCP using IPv6.
What should you do?

  • A. Configure a global load balancer with the designated IPv6 address.
  • B. Create the instance with the designated IPv6 address.
  • C. Configure a TCP Proxy with the designated IPv6 address.
  • D. Configure an internal load balancer with the designated IPv6 address.

正解：A

解説：
https://cloud.google.com/load-balancing/docs/ipv6


質問 # 60
All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?

  • A. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
  • B. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
  • C. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
  • D. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.

正解：A


質問 # 61
You are responsible for designing a new connectivity solution for your organization's enterprise network to access and use Google Workspace. You have an existing Shared VPC with Compute Engine instances in us-west1. Currently, you access Google Workspace via your service provider's internet access. You want to set up a direct connection between your network and Google. What should you do?

  • A. Order a Dedicated Interconnect connection in the same metropolitan area. Create a VLAN attachment, a Cloud Router in us-west1, and a Border Gateway Protocol (BGP) session between your Cloud Router and your router.
  • B. Order a Direct Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.
  • C. Configure HA VPN in us-west1. Configure a Border Gateway Protocol (BGP) session between your Cloud Router and your on-premises data center.
  • D. Order a Carrier Peering connection in the same metropolitan area. Configure a Border Gateway Protocol (BGP) session between Google and your router.

正解：B


質問 # 62
You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses.
Which subnet mask should you use for the Pod IP address range?

  • A. /21
  • B. /23
  • C. /22
  • D. /25

正解：D

解説：
Reference:
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips


質問 # 63
......

Professional-Cloud-Network-Engineer試験問題集でPDF問題とテストエンジン：https://www.passtest.jp/Google/Professional-Cloud-Network-Engineer-shiken.html

Professional-Cloud-Network-Engineer問題集で必ず合格させる試験：https://drive.google.com/open?id=1N_6zNdJWe_7Q_Gda1ltUkQG3rfwNZ5LI

関するブログ

もっと
Professional-Cloud-Network-Engineer 無料問題集