IT分野での実力を示す指標として、Google Cloud Certified - Professional Cloud Network Engineerは多くの企業から評価されている認定資格です。GoShikenのProfessional-Cloud-Network-Engineer練習問題236問は、公式の出題範囲に基づいて作成されています。

Google Professional-Cloud-Network-Engineer 試験概要:

Google Professional-Cloud-Network-Engineer 試験シラバストピック:

Google Cloud Certified - Professional Cloud Network Engineerのよくある疑問を解決します

Google Cloud Certified - Professional Cloud Network Engineer 認定 Professional-Cloud-Network-Engineer 試験問題：

問題 #1

(You are deploying an application to Google Kubernetes Engine (GKE). The application needs to make API calls to a private Cloud Storage bucket. You need to configure your application Pods to authenticate to the Cloud Storage API, but your organization policy prevents the usage of service account keys. You want to follow Google-recommended practices. What should you do?)

A. Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 24 hours.
B. Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 8 hours.
C. Create the GKE cluster with Workload Identity Federation. Create a Google service account and a Kubernetes ServiceAccount, and configure both service accounts to use Workload Identity Federation.Attach the Kubernetes ServiceAccount to the application Pods and configure the Google service account to access the bucket with Identity and Access Management (IAM).
D. Create the GKE cluster with Workload Identity Federation. Configure the default node service account to access the bucket. Deploy the application into the cluster so the application can use the node service account permissions. Use Identity and Access Management (IAM) to grant the service account access to the bucket.

問題 #2

You are deploying a global external TCP load balancing solution and want to preserve the source IP address of the original layer 3 payload.
Which type of load balancer should you use?

A. TCP/SSL proxy load balancer
B. Network load balancer
C. Internal load balancer
D. HTTP(S) load balancer

問題 #3

Your company's on-premises network is connected to a VPC using a Cloud VPN tunnel. You have a static route of 0.0.0.0/0 with the VPN tunnel as its next hop defined in the VPC. All internet bound traffic currently passes through the on-premises network. You configured Cloud NAT to translate the primary IP addresses of Compute Engine instances in one region. Traffic from those instances will now reach the internet directly from their VPC and not from the on-premises network. Traffic from the virtual machines (VMs) is not translating addresses as expected. What should you do?

A. Add firewall rules that allow ingress and egress of the external NAT IP address, have a target tag that is on the Compute Engine instances, and have a priority value higher than the priority value of the default route to the VPN gateway.
B. Increase the default min-ports-per-vm setting for the Cloud NAT gateway.
C. Add a default static route to the VPC with the default internet gateway as the next hop, the network tag associated with the Compute Engine instances, and a higher priority than the priority of the default route to the VPN tunnel.
D. Lower the TCP Established Connection Idle Timeout for the NAT gateway.

問題 #4

You are developing an HTTP API hosted on a Compute Engine virtual machine instance that must be invoked only by multiple clients within the same Virtual Private Cloud (VPC). You want clients to be able to get the IP address of the service. What should you do?

A. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url
https://[INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal/.
B. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url
https://[API_NAME]/[API_VERSION]/.
C. Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule. Clients should use this IP address to connect to the service.
D. Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule. Then, define an A record in Cloud DNS. Clients should use the name of the A record to connect to the service.

問題 #5

You recently deployed your application in Google Cloud. You need to verify your Google Cloud network configuration before deploying your on-premises workloads. You want to confirm that your Google Cloud network configuration allows traffic to flow from your cloud resources to your on- premises network. This validation should also analyze and diagnose potential failure points in your Google Cloud network configurations without sending any data plane test traffic. What should you do?

A. Enable Packet Mirroring on your application and send test traffic.
B. Enable VPC Flow Logs and send test traffic.
C. Use Network Intelligence Center's Connectivity Tests.
D. Use Network Intelligence Center's Network Topology visualizations.

解説：