2025年最新のの検証済みProfessional-Cloud-Network-Engineer問題と解答で合格保証 もしくは全額返金
[2025年05月]更新のProfessional-Cloud-Network-Engineer認証と実際の解答はここにあるPassTest
質問 # 38
You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network Currently, there Is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability What should you do?
- A. Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
- B. Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
- C. Use HA VPN. Configure one tunnel from each Interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.
- D. Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
正解：D
質問 # 39
All the instances in your project are configured with the custom metadata enable-osloginvalue set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project- wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?
- A. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
- B. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
- C. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
- D. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
正解：A
解説：
Explanation/Reference: https://cloud.google.com/compute/docs/storing-retrieving-metadata
質問 # 40
You create multiple Compute Engine virtual machine instances to be used as TFTP servers.
Which type of load balancer should you use?
- A. TCP proxy load balancer
- B. HTTP(S) load balancer
- C. SSL proxy load balancer
- D. Network load balancer
正解：D
質問 # 41
You have configured a Compute Engine virtual machine instance as a NAT gateway. You execute the following command:
gcloud compute routes create no-ip-internet-route \
--network custom-network1 \
--destination-range 0.0.0.0/0 \
--next-hop instance nat-gateway \
--next-hop instance-zone us-central1-a \
--tags no-ip --priority 800
You want existing instances to use the new NAT gateway. Which command should you execute?
- A. gcloud builds submit --config=cloudbuild.waml --substitutions=TAG_NAME=no-ip
- B. gcloud compute instances add-tags [existing-instance] --tags no-ip
- C. sudo sysctl -w net.ipv4.ip_forward=1
- D. gcloud compute instances create example-instance --network custom-network1 \
--subnet subnet-us-central \
--no-address \
--zone us-central1-a \
--image-family debian-9 \
--image-project debian-cloud \
--tags no-ip
正解：B
解説：
https://cloud.google.com/sdk/gcloud/reference/compute/routes/create
In order to apply a route to an existing instance we should use a tag to bind the route to it.
質問 # 42
Your organization has a new security policy that requires you to monitor all egress traffic payloads from your virtual machines in the us-west2 region. You deployed an intrusion detection system (IDS) virtual appliance in the same region to meet the new policy. You now need to integrate the IDS into the environment to monitor all egress traffic payloads from us-west2. What should you do?
- A. Enable firewall logging and forward all filtered egress firewall logs to the IDS.
- B. Enable VPC Flow Logs. Create a sink in Cloud Logging to send filtered egress VPC Flow Logs to the IDS.
- C. Create an internal TCP/UDP load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.
- D. Create an internal HTTP(S) load balancer for Packet Mirroring, and add a packet mirroring policy filter for egress traffic.
正解：C
解説：
Packet Mirroring with an internal TCP/UDP load balancer allows for comprehensive monitoring of egress traffic, which includes payloads. This is required for integration with an IDS for detailed inspection of traffic payloads, meeting the security policy needs for monitoring and detection.
質問 # 43
You have setup a shared VPC and you have created three projects; Host Project, Service Project-1 and Service Project-2. You have created two subnets, subnet-1 in us-west1 and subnet-
2 in us-central1 in the Host Project. Only subnet-1 has been shared with Service Project -1 but when you go to VPC networks in Service Project-1 you also see subnet-2 which hasn't been shared with Service Project-1. Please select the correct option from below why is subnet-2 available to Service Project-1. Note Host Project is the Host Project in the shared VPC, Service Project-1 and Service project-2 are the Service Projects in the shared VPC.
- A. It is a bug in Google Cloud, please report it.
- B. Remove Shared Network admin role to the current user.
- C. By default all subnets are available.
- D. The current user has Shared VPC Admin role and with Shared VPC Admin role all the networks are available.
正解：D
解説：
Option A is the Correct choice because , if the current user has Shared VPC Admin role then all the networks in the shared VPC is the available to the user irrespective of subnet level sharing permission with the Service Projects.
Option B is Incorrect because , it is not a bug .
Option C is Incorrect because ,all the subnets would be available if the current user has Shared Admin role.
Option D is Incorrect because ,Shared Network Admin role doesn't exist.
質問 # 44
You are designing an IP address scheme for new private Google Kubernetes Engine (GKE) clusters. Due to IP address exhaustion of the RFC 1918 address space In your enterprise, you plan to use privately used public IP space for the new clusters. You want to follow Google-recommended practices. What should you do after designing your IP scheme?
- A. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster with the following options selected and
- B. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters Re-use the secondary address range for the services across multiple private GKE clusters
- C. Create the minimum usable RFC 1918 primary and secondary subnet IP ranges for the clusters. Re-use the secondary address range for the pods across multiple private GKE clusters
- D. Create privately used public IP primary and secondary subnet ranges for the clusters. Create a private GKE cluster With the following options selected --disable-default-snat, -enable-ip-alias, and-enable-private-nodes
正解：D
解説：
This answer follows the Google-recommended practices for using privately used public IP (PUPI) addresses for GKE Pod address blocks1. The benefits of this approach are:
It allows you to use any public IP addresses that are not owned by Google or your organization for your Pods, which can help mitigate address exhaustion in your enterprise.
It prevents any external traffic from reaching your Pods, as Google Cloud does not route PUPI addresses to the internet or to other VPC networks by default.
It enables you to use VPC Network Peering to connect your GKE cluster to other VPC networks that use different PUPI addresses, as long as you enable the export and import of custom routes for the peering connection.
It preserves the fully integrated network model of GKE, where Pods can communicate with nodes and other resources in the same VPC network without NAT.
The options that you need to select when creating a private GKE cluster with PUPI addresses are:
-disable-default-snat: This option disables source NAT for outbound traffic from Pods to destinations outside the cluster's VPC network. This is necessary to prevent Pods from using RFC 1918 addresses as their source IP addresses, which could cause conflicts with other networks that use the same address space2.
-enable-ip-alias: This option enables alias IP ranges for Pods and Services, which allows you to use separate subnet ranges for them. This is required to use PUPI addresses for Pods1.
-enable-private-nodes: This option creates a private cluster, where nodes do not have external IP addresses and can only communicate with the control plane through a private endpoint. This enhances the security and privacy of your cluster3.
Option A is incorrect because it does not use PUPI addresses for Pods, but rather RFC 1918 addresses. This does not solve the problem of address exhaustion in your enterprise. Option B is incorrect because it reuses the secondary address range for Services across multiple private GKE clusters, which could cause IP conflicts and routing issues. Option C is incorrect because it does not specify the options that are needed to create a private GKE cluster with PUPI addresses.
1: Configuring privately used public IPs for GKE | Kubernetes Engine | Google Cloud 2: Using Cloud NAT with GKE | Kubernetes Engine | Google Cloud 3: Private clusters | Kubernetes Engine | Google Cloud
質問 # 45
An application development team believes their current logging tool will not meet their needs for their new cloud-based product. They want a better tool to capture errors and help them analyze their historical log data. You want to help them find a solution that meets their needs, what should you do?
- A. Help them define their requirements and assess viable logging tools.
- B. Send them a list of online resources about logging best practices.
- C. Help them upgrade their current tool to take advantage of any new features.
- D. Direct them to download and install the Google StackDriver logging agent.
正解：A
解説：
A and D can be ruled out for them are not general IT good practices. They need your help, not just simply to sell your products, or point them to the crowded resource without explains.
B (Correct Answer) - Help them define their requirements and assess viable logging tools. They know the requirements and the existing tools' problems. While it's true StackDriver Logging and Error Reporting meet all their requirements, they need you to provide expertise to make assessment for new tools, specifically, logging tools that can capture errors and help them analyze their historical log data?
C - Help them upgrade their current tool to take advantage of any new features. They have already used and know those tools' shortcomings. They need your help to find better one. Simply help them upgrade for new features is not enough and may not resolve the problems
質問 # 46
You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/ Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection.
Which two actions can accomplish this? (Choose two.)
- A. Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
- B. Run gcloud compute interconnects describe <interconnect>.
- C. Contact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.
- D. Open a Cloud Support ticket under the Cloud Interconnect category.
- E. Check the email for the account of the NOC contact that you specified during the ordering process.
正解：C、E
質問 # 47
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?
- A. Assign members of the networking team the compute.networkAdmin role.
- B. Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
- C. Assign members of the networking team the compute.networkUser role.
- D. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.
正解：A
解説：
https://cloud.google.com/compute/docs/access/iam
質問 # 48
Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue. What should you do?
- A. Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.
- B. Create custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
- C. Create custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.
- D. Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
正解：A
解説：
Creating a BGP route policy at the Cloud Router ensures that the subnets of the VPC spokes are properly advertised to the on-premises environment. This allows the on-premises router to receive and use those routes. Without the correct BGP policies, route advertisement may not happen as expected.
質問 # 49
A database virtual machine on Google Compute Engine has an ext4-formatted persistent disk for data files. The database is about to run out of storage space How can you remediate the problem with the least amount of downtime?
- A. In the Cloud Platform Console, increase the size of the persistent disk and use the resize2fs command in Linux.
- B. In the Cloud Platform Console, create a snapshot of the persistent disk, restore the snapshot to a new larger disk, unmount the old disk, mount the new disk, and restart the database service.
- C. In the Cloud Platform Console, increase the size of the persistent disk and verify the new space is ready to use with the fdisk command in Linux.
- D. Shut down the virtual machine, use the Cloud Platform Console to increase the persistent disk size, then restart the virtual machine.
- E. In the Cloud Platform Console, create a new persistent disk attached to the virtual machine, format and mount it, and configure the database service to move the files to the new disk.
正解：A
解説：
A (Correct answer) - In the Cloud Platform Console, increase the size of the persistent disk and use the resize2fs command in Linux.
Here are the steps: In the Cloud Platform Console, increase the size of the persistent disk; after indicating size increase in console, to make the new size effective, you have two options: restart the VM or configure in the VM's operating systems, Windows or Linux.
質問 # 50
You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?
- A. Client IP
- B. Client IP, port and protocol
- C. None
- D. Client IP and protocol
正解：A
質問 # 51
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-pathto a specific URL used for health checking, and set proxy-headerto PROXY_V1.
- B. Set request-path to a specific URL used for health checking, and set hostto include a custom host header that identifies the health check.
- C. Set request-path to a specific URL used for health checking, and set responseto a string that the backend service will always return in the response body.
- D. Set proxy-header to the default value, and set hostto include a custom host header that identifies the health check.
正解：B
解説：
https://cloud.google.com/load-balancing/docs/health-checks
質問 # 52
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
- B. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
- C. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- D. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
正解：D
解説：
Explanation/Reference: https://link.springer.com/chapter/10.1007/978-1-4842-1004-8_4
質問 # 53
You have the networking configuration shown in the diagram. A pair of redundant Dedicated Interconnect connections (int-Igal and int-Iga2) terminate on the same Cloud Router. The Interconnect connections terminate on two separate on-premises routers. You are advertising the same prefixes from the Border Gateway Protocol (BGP) sessions associated with the Dedicated Interconnect connections. You need to configure one connection as Active for both ingress and egress traffic. If the active Interconnect connection fails, you want the passive Interconnect connection to automatically begin routing all traffic Which two actions should you take to meet this requirement? (Choose Two)
- A. Configure the advertised route priority > 10,200 on the active Interconnect connection.
- B. Configure the advertised route priority as 200 for the BGP session associated with the active Interconnect connection.
- C. Advertise a lower MED on the passive Interconnect connection from the on-premises router
- D. Configure the advertised route priority as 200 for the BGP session associated with the passive Interconnect connection.
- E. Advertise a lower MED on the active Interconnect connection from the on-premises router
正解：B、E
解説：
This answer meets the requirement of configuring one connection as Active for both ingress and egress traffic, and enabling automatic failover to the passive connection in case of failure. The reason is:
The advertised route priority is a value that Cloud Router uses to set the route priority when advertising routes to your on-premises router. The lower the value, the higher the priority1. By setting the advertised route priority as 200 for the active connection, you ensure that it has a higher priority than the passive connection, which has the default value of 1001. This way, your on-premises router will prefer the routes from the active connection over the passive one for ingress traffic.
The MED (Multi-Exit Discriminator) is a value that your on-premises router uses to indicate its preference for receiving traffic from Cloud Router. The lower the value, the higher the preference2. By advertising a lower MED on the active connection from your on-premises router, you ensure that Cloud Router will prefer sending traffic to the active connection over the passive one for egress traffic.
If the active connection fails, Cloud Router will stop receiving routes from it and will start using the routes from the passive connection for egress traffic. Similarly, your on-premises router will stop receiving routes with priority 200 from the active connection and will start using the routes with priority 100 from the passive connection for ingress traffic. This achieves automatic failover without any manual intervention.
Option A is incorrect because setting the advertised route priority > 10,200 on the active connection would deprioritize it globally in your VPC network, which is not what you want1. Option B is incorrect because advertising a lower MED on the passive connection would make Cloud Router prefer sending traffic to it over the active one, which is not what you want2. Option D is incorrect because setting the advertised route priority as 200 for both connections would make them equally preferred by your on-premises router, which is not what you want1.
Reference:
Update the base route priority | Cloud Router | Google Cloud
Configuring BGP sessions | Cloud Router | Google Cloud
質問 # 54
You want to create a service in GCP using IPv6.
What should you do?
- A. Create the instance with the designated IPv6 address.
- B. Configure a global load balancer with the designated IPv6 address.
- C. Configure a TCP Proxy with the designated IPv6 address.
- D. Configure an internal load balancer with the designated IPv6 address.
正解：B
解説：
https://cloud.google.com/load-balancing/docs/load-balancing-overview mentions to use global load balancer for IPv6 termination.
質問 # 55
You work for a university that is migrating to Google Cloud.
These are the cloud requirements:
On-premises connectivity with 10 Gbps
Lowest latency access to the cloud
Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
- B. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Dedicated Interconnects.
- C. Use standalone projects and deploy the VLAN attachments and Dedicated Interconnects in each of the individual projects.
- D. Use Shared VPC, and deploy the VLAN attachments and Dedicated Interconnect in the host project.
正解：D
質問 # 56
Your organization has a hub and spoke architecture with VPC Network Peering, and hybrid connectivity is centralized at the hub. The Cloud Router in the hub VPC is advertising subnet routes, but the on-premises router does not appear to be receiving any subnet routes from the VPC spokes. You need to resolve this issue. What should you do?
- A. Create a BGP route policy at the Cloud Router, and ensure the subnets of the VPC spokes are being announced towards the on-premises environment.
- B. Create custom learned routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
- C. Create custom routes at the Cloud Router in the spokes to advertise the subnets of the VPC spokes.
- D. Create custom routes at the Cloud Router in the hub to advertise the subnets of the VPC spokes.
正解：B
解説：
Creating custom learned routes at the hub's Cloud Router is required for advertising VPC spokes' subnets to the on-premises environment. This centralizes route configuration and ensures that all spoke subnet routes are propagated to the hybrid network.
質問 # 57
Your developer group works on a set of VM's frequently throughout the day. To save costs, you terminate the VM when it is not in use. However, you need to preserve the contents of the disk when the VM is terminated so users can resume where they left off when a new one is created.
What is the most cost-effective way to do? (Choose two)
- A. Take a snapshot of the disk before terminating the VM.
- B. Back up the disk contents to Cloud Storage before deleting.
- C. When not in use, only stop the instance instead of deleting it.
- D. Set the disk to no-auto-delete to preserve contents.
正解：C、D
解説：
A (Correct Answer) - Set the disk to no-auto-delete to preserve contents. Setting your instance to not delete the root disk when deleting the instance will preserve the disk contents to attach to a new instance.
C (Correct Answer) - When not in use, only stop the instance instead of deleting it. Alternatively, you can merely stop the instance instead of deleting it, during which time you will not be billed for Machine Type usage (just disk storage).
B and D may work but are not suitable solutions since the VMs may need frequently stop and resume throughout the day.
More Information:
https://cloud.google.com/sdk/gcloud/reference/compute/instances/set-disk-auto-delete
質問 # 58
You need to create a GKE cluster in an existing VPC that is accessible from on-premises. You must meet the following requirements:
* IP ranges for pods and services must be as small as possible.
* The nodes and the master must not be reachable from the internet.
* You must be able to use kubectl commands from on-premises subnets to manage the cluster.
How should you create the GKE cluster?
- A. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable privateEndpoint on the cluster master.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - B. * Create a VPC-native GKE cluster using user-managed IP ranges.
* Enable a GKE cluster network policy, set the pod and service ranges as /24.
* Set up a network proxy to access the master.
* Enable master authorized networks. - C. * Create a VPC-native GKE cluster using GKE-managed IP ranges.
* Set the pod IP range as /21 and service IP range as /24.
* Set up a network proxy to access the master. - D. * Create a private cluster that uses VPC advanced routes.
* Set the pod and service ranges as /24.
* Set up a network proxy to access the master.
正解：B
解説：
Reference:
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips
質問 # 59
You are migrating to Cloud DNS and want to import your BIND zone file.
Which command should you use?
- A. gcloud dns record-sets import ZONE_FILE --replace-origin-ns --zone MANAGED_ZONE
- B. gcloud dns record-sets import ZONE_FILE --zone-file-format --zone MANAGED_ZONE
- C. gcloud dns record-sets import ZONE_FILE --delete-all-existing --zone MANAGED ZONE
- D. gcloud dns record-sets import ZONE_FILE --zone MANAGED_ZONE
正解：B
解説：
Once you have the exported file from your other provider, you can use the gcloud dns record-sets import command to import it into your managed zone.
To import record-sets, you use the dns record-sets import command. The --zone-file-format flag tells importto expect a BIND zone formatted file. If you omit this flag, import expects a YAML- formatted records file.
https://medium.com/@prashantapaudel/gcp-certification-series-2-4-planning-and-configuring- network-resources-8045ac2cc2ac
質問 # 60
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
- B. Manually patch some of the instances, and then perform a rolling restart on the instance group.
- C. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
- D. Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
正解：A
質問 # 61
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:
Your ISP is a Google Partner Interconnect provider.
Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps.
A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses.
Most of the data transfer will be from GCP to the on-premises environment.
The application can burst up to 1.5 Gbps during peak transfers over the Interconnect.
Cost and the complexity of the solution should be minimal.
How should you provision the connectivity solution?
- A. Provision a Partner Interconnect through your ISP.
- B. Use network compression over your VPN to increase the amount of data you can send over your VPN.
- C. Create multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
- D. Provision a Dedicated Interconnect instead of a VPN.
正解：A
解説：
Direct Interconnect will be too expensive and also an overkill for this requirement. Managing multiple tunnels that too with packet loss consideration is complex also. Whereas partner interconnect fits the bill with providing required bandwidth but not super expensive also once setup not too complex too manage.
質問 # 62
You are deploying an application that runs on Compute Engine instances. You need to determine how to expose your application to a new customer You must ensure that your application meets the following requirements
* Maps multiple existing reserved external IP addresses to the Instance
* Processes IP Encapsulating Security Payload (ESP) traffic
What should you do?
- A. Configure a target pool, and create protocol forwarding rules for each external IP address.
- B. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
- C. Configure a backend service, and create an external network load balancer for each external IP address
- D. Configure the Compute Engine Instances' network Interface external IP address from None to Ephemeral Add as many external IP addresses as required
正解：B
解説：
The correct answer is C. Configure a target instance, and create a protocol forwarding rule for each external IP address to be mapped to the instance.
This answer is based on the following facts:
A target instance is a Compute Engine instance that handles traffic from one or more forwarding rules1. You can use target instances to forward traffic to a single VM instance from one or more external IP addresses2.
A protocol forwarding rule specifies the IP protocol and port range for the traffic that you want to forward3. You can use protocol forwarding rules to forward traffic of any IP protocol, including ESP4.
The other options are not correct because:
Option A is not possible. You cannot create protocol forwarding rules for a target pool. A target pool is a group of instances that receives traffic from a network load balancer5.
Option B is not suitable. You do not need to create an external network load balancer for each external IP address. An external network load balancer distributes traffic among multiple backend instances based on the destination IP address and port. You can use a single load balancer with multiple forwarding rules to map multiple external IP addresses to the same backend service.
Option D is not feasible. You cannot add multiple external IP addresses to a single network interface of a Compute Engine instance. Each network interface can have only one external IP address that is either ephemeral or static. You can use alias IP ranges to assign multiple internal IP addresses to a single network interface, but not external IP addresses.
質問 # 63
......
Professional-Cloud-Network-Engineerリアル有効で正確な問題集213問題と解答が待ってます：https://www.passtest.jp/Google/Professional-Cloud-Network-Engineer-shiken.html
最新のProfessional-Cloud-Network-Engineer問題集でPDF：https://drive.google.com/open?id=107avTecFOx6DsR9nAgRPUn3Uac0wmsdQ