[2025年06月]更新のProfessional-Cloud-Network-Engineer試験問題集、Professional-Cloud-Network-Engineer練習テスト問題
検証済みProfessional-Cloud-Network-Engineer問題集PDF資料 [2025]
Google Professional-Cloud-Network-Engineer 認定は、IT プロフェッショナルがクラウドネットワーク技術に関する専門知識や Google Cloud Platform との作業能力を証明するための優れた方法です。この認定は、クラウドネットワークポジションに適任な候補者を求める雇用主にとって、グローバルに認められ、高く評価されています。受験者は、オンライントレーニングコース、模擬試験、勉強ガイドなど、Google Cloud が提供する多数のリソースを活用して試験に備えることができます。適切な準備と経験を持つ受験者は、試験に合格し、クラウドネットワーク技術に関する知識とスキルを証明する認定を獲得することができます。
質問 # 109
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with a unique ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* BGP sessions are established between both on-premises routers and the Cloud Router.
* Only 1 of the on-premises router's routes are being added to the routing table.
What is the most likely cause of this problem?
- A. The ASNs being used on the on-premises routers are different.
- B. The on-premises routers are configured with the same routes.
- C. A firewall is blocking the traffic across the second VPN connection.
- D. You do not have a load balancer to load-balance the network traffic.
正解：A
解説：
https://cloud.google.com/network-connectivity/docs/router/support/troubleshooting#ecmp
質問 # 110
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security?
(Choose two.)
- A. Cloud NAT
- B. Dedicated Interconnect
- C. Shared VPC
- D. VPC peering
- E. Cloud VPN
正解：B、E
解説：
Explanation/Reference: https://cloud.google.com/vpc/docs/vpc
質問 # 111
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- B. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
- C. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- D. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
正解：C
解説：
https://cloud.google.com/vpc/docs/vpc-peering
質問 # 112
Your company runs an enterprise platform on-premises using virtual machines (VMS). Your internet customers have created tens of thousands of DNS domains panting to your public IP addresses allocated to the Vtvls Typically, your customers hard-code your IP addresses In their DNS records You are now planning to migrate the platform to Compute Engine and you want to use Bring your Own IP you want to minimize disruption to the Platform What Should you d0?
- A. Verify ownership of your IP addresses. After the verification, Google Cloud advertises and provisions the IP prefix for you_ Assign the IP addresses to the Compute Engine Instances
- B. Create a VPC With the same IP address range as your on-premises network Asson the IP addresses to the Compute Engine Instances.
- C. Verify ownership of your IP addresses. Use live migration to import the prefix Assign the IP addresses to Compute Engine instances.
- D. Create a VPC and request static external IP addresses from Google Cloud Assagn the IP addresses to the Compute Engine instances. Notify your customers of the new IP addresses so they can update their DNS
正解：C
解説：
The correct answer is D because it allows you to use your own public IP addresses in Google Cloud without disrupting the platform or requiring your customers to update their DNS records. Option A is incorrect because it involves changing the IP addresses and notifying the customers, which can cause disruption and errors. Option B is incorrect because it does not use live migration, which is a feature that lets you control when Google starts advertising routes for your prefix. Option C is incorrect because it does not involve bringing your own IP addresses, but rather using Google-provided IP addresses.
Reference:
Bring your own IP addresses
Professional Cloud Network Engineer Exam Guide
Bring your own IP addresses (BYOIP) to Azure with Custom IP Prefix
質問 # 113
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?
- A. Configure global load balancing to point 172.16.45.0/24 to the correct instance.
- B. Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.
- C. Create unique DNS records for each service that sends traffic to the desired IP address.
- D. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.
正解：C
質問 # 114
Question:
Your organization has an on-premises data center. You need to provide connectivity from the on-premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet.
What should you do?
- A. Configure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.
- B. Configure HA VPN by using high availability gateways and tunnels.
- C. Configure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.
- D. Configure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.
正解：C
解説：
For private connectivity with at least 1 Gbps bandwidth and without using the public internet, Partner Interconnect is the suitable choice if you do not require the 10 Gbps minimum of Dedicated Interconnect.
With Partner Interconnect, you create a VLAN attachment and work with a service provider that facilitates the connection between your on-premises network and Google Cloud. This solution supports connections as low as 50 Mbps and up to 10 Gbps.
質問 # 115
You are configuring a new application that will be exposed behind an external load balancer with both IPv4 and IPv6 addresses and support TCP pass-through on port 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest possible latency while ensuring high availability and autoscaling. Which configuration should you use?
- A. Use global TCP Proxy Load Balancing with backends in both regions.
- B. Use Network Load Balancing in both regions, and use DNS-based load balancing to direct traffic to the closest region.
- C. Use global SSL Proxy Load Balancing with backends in both regions.
- D. Use global external HTTP(S) Load Balancing with backends in both regions.
正解：B
質問 # 116
Your organization uses a Shared VPC architecture with a host project and three service projects. You have Compute Engine instances that reside in the service projects. You have critical workloads in your on-premises data center. You need to ensure that the Google Cloud instances can resolve on-premises hostnames via the Dedicated Interconnect you deployed to establish hybrid connectivity. What should you do?
- A. Configure a Cloud DNS private zone in the host project of the Shared VPC.
Set up DNS forwarding to your Google Cloud private zone on your on-premises DNS servers to point to the inbound forwarder IP address in your host project.
Configure a DNS policy in the Shared VPC to allow inbound query forwarding with your on-premises DNS server as the alternative DNS server. - B. Configure a Cloud DNS private zone in the host project of the Shared VPC.
Set up DNS forwarding to your Google Cloud private zone on your on-premises DNS servers to point to the inbound forwarder IP address in your host project In your Cloud Router, add a custom route advertisement for the IP 169.254 169 254 to the on-premises environment. - C. Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the private zone to the on-premises DNS servers.
In your Cloud Router, add a custom route advertisement for the IP 35.199.192.0/19 to the on-premises environment. - D. Create a Cloud DNS private forwarding zone in the host project of the Shared VPC that forwards the Private zone to the on-premises DNS servers.
In your Cloud Router, add a custom route advertisement for the IP 169.254 169.254 to the on-premises environment.
正解：A
質問 # 117
You recently deployed two network virtual appliances in us-central1. Your network appliances provide connectivity to your on-premises network, 10.0.0.0/8. You need to configure the routing for your Virtual Private Cloud (VPC). Your design must meet the following requirements:
All access to your on-premises network must go through the network virtual appliances.
Allow on-premises access in the event of a single network virtual appliance failure.
Both network virtual appliances must be used simultaneously.
Which method should you use to accomplish this?
- A. Configure two routes for 10.0.0.0/8 with different priorities, each pointing to separate network virtual appliances.
- B. Configure an internal HTTP(S) load balancer with the two network virtual appliances as backends.
Configure a route for 10.0.0.0/8 with the internal HTTP(S) load balancer as the next hop. - C. Configure an internal TCP/UDP load balancer with the two network virtual appliances as backends.Configure a route for 10.0.0.0/8 with the internal load balancer as the next hop.
- D. Configure a network load balancer for the two network virtual appliances. Configure a route for 10.0.0.0
/8 with the network load balancer as the next hop.
正解：B
質問 # 118
In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost:
Port 8080 should always be open for VMs in the projects in the Dev folder.
Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder.
What should you do?
- A. Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev VMs and deny traffic to port 8080 on the Prod VMs.
- B. In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.
- C. Create and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
- D. Create a Shared VPC for the Dev projects and a Shared VPC for the Prod projects. Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall rule to deny traffic to port
8080 in the Shared VPC for Prod. Deploy VMs to those Shared VPCs.
正解：C
質問 # 119
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?
- A. Set the zone to the TRANSFER state.
- B. Transfer ownership of the domain to a new registar.
- C. Update the TTL for the zone.
- D. Disable DNSSEC at your domain registar.
正解：D
解説：
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone.
https://cloud.google.com/dns/docs/dnssec-config
質問 # 120
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?
- A. Assign members of the networking team the compute.networkUser role.
- B. Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
- C. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.
- D. Assign members of the networking team the compute.networkAdmin role.
正解：D
解説：
https://cloud.google.com/compute/docs/access/iam
質問 # 121
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Compress files using utilities like tar to reduce the size of data being sent.
- B. Remove the -m flag from the gsutil command to enable single-threaded transfers.
- C. Tune TCP parameters on the on-premises servers.
- D. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
正解：D
質問 # 122
You need to create a new VPC network that allows instances to have IP addresses in both the 10.1.1.0/24 network and the 172.16.45.0/24 network.
What should you do?
- A. Configure global load balancing to point 172.16.45.0/24 to the correct instance.
- B. Use VPC peering to allow traffic to route between the 10.1.0.0/24 network and the 172.16.45.0/24 network.
- C. Configure an alias-IP range of 172.16.45.0/24 on the virtual instances within the VPC subnet of 10.1.1.0/24.
- D. Create unique DNS records for each service that sends traffic to the desired IP address.
正解：C
質問 # 123
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are 100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Compress files using utilities like tar to reduce the size of data being sent.
- B. Remove the -m flag from the gsutil command to enable single-threaded transfers.
- C. Tune TCP parameters on the on-premises servers.
- D. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
正解：D
解説：
Explanation/Reference: https://cloud.google.com/solutions/transferring-big-data-sets-to-gcp
質問 # 124
Your company's logo is published as an image file across multiple websites that are hosted by your company You have implemented Cloud CDN, however, you want to improve the performance of the cache hit ratio associated with this image file. What should you do?
- A. Configure the default time to live (TTL) as O for the image file.
- B. Configure custom cache keys for the backend service that holds the image file, and clear the Host and Protocol checkboxes-
- C. Configure Cloud Storage as a custom origin backend to host the image file, and select multi-region as the location type
- D. Configure versioned IJRLs for each domain to serve users the *mage file before the cache entry expires
正解：B
解説：
This answer meets the requirement of improving the performance of the cache hit ratio associated with the image file. The reason is:
* Custom cache keys allow you to control which parts of the request URL are used to build the cache key. The cache key is a unique identifier that Cloud CDN uses to store and retrieve cached content1.
* By default, Cloud CDN uses the complete request URL, including the protocol (http or https) and the host (the domain name), to build the cache key. This means that if the same image file is requested from different domains or protocols, Cloud CDN will cache multiple copies of it, which reduces the cache hit ratio1.
* By clearing the Host and Protocol checkboxes, you can tell Cloud CDN to ignore these parts of the request URL when building the cache key. This way, Cloud CDN will cache only one copy of the image file, regardless of which domain or protocol it is requested from, which improves the cache hit ratio1.
Option B is incorrect because configuring Cloud Storage as a custom origin backend does not affect the cache hit ratio. It only affects how Cloud CDN retrieves the content from the origin if it is not cached. Option C is incorrect because configuring versioned URLs for each domain does not improve the cache hit ratio. It actually worsens it, because it creates more variations of the request URL that Cloud CDN has to cache separately. Option D is incorrect because configuring the default TTL as 0 for the image file means that Cloud CDN will not cache it at all, which defeats the purpose of using Cloud CDN.
質問 # 125
You recently deployed Cloud VPN to connect your on-premises data center to Google Cloud. You need to monitor the usage of this VPN and set up alerts in case traffic exceeds the maximum allowed. You need to be able to quickly decide whether to add extra links or move to a Dedicated Interconnect. What should you do?
- A. In the Google Cloud console, use Monitoring Query Language to create a custom alert for bandwidth utilization.
- B. In Network Intelligence Center, check for the number of packet drops on the VPN.
- C. In the VPN section of the Google Cloud console, select the VPN under hybrid connectivity and then select monitoring to display utilization on the dashboard.
- D. In the Monitoring section of the Google Cloud console, use the Dashboard section to select a default dashboard for VPN usage.
正解：A
解説：
Using Monitoring Query Language (MQL) to create a custom alert for bandwidth utilization gives you flexibility and precision in setting thresholds. This helps you quickly determine when VPN traffic exceeds the limits, allowing for timely decisions about adding more links or transitioning to a Dedicated Interconnect.
質問 # 126
......
この試験は50問の多肢選択問題から構成され、2時間以内に完了する必要があります。合格するには、最低70％のスコアが必要であり、Google Cloud Certified - Professional Cloud Network Engineer認定を取得することができます。試験は、ネットワーク設計とアーキテクチャ、ネットワークセキュリティ、ネットワーク最適化、ネットワーク監視および管理など、幅広いトピックをカバーしています。候補者は、ネットワークの概念とプロトコルについて確固たる理解を持ち、これらの概念を実世界のネットワーク設計と実装シナリオに適用する能力を持っている必要があります。
最新のProfessional-Cloud-Network-Engineer実際の無料試験問題は更新された222問あります：https://www.passtest.jp/Google/Professional-Cloud-Network-Engineer-shiken.html
無料Professional-Cloud-Network-Engineer試験ブレーン問題集認定ガイド問題と解答：https://drive.google.com/open?id=11U_xZeWP3cra1WzXjV4cb3oqyeSESzsF