お手軽に合格させる 最新Google Professional-Cloud-Network-Engineer問題集には162問があります
最新のProfessional-Cloud-Network-Engineer学習ガイド2023年最新の- 提供するのはテストエンジンとPDF
質問 # 62
You create multiple Compute Engine virtual machine instances to be used at TFTP servers.
Which type of load balancer should you use?
- A. TCP proxy load balancer
- B. HTTP(S) load balancer
- C. SSL proxy load balancer
- D. Network load balancer
正解：C
質問 # 63
Your company's security team tends to use managed services when possible. You need to build a dashboard to show the number of deny hits that occur against configured firewall rules without increasing operational overhead. What should you do?
- A. Configure Packet Mirroring on the VPC. Apply a filter with an IP address list of the Denied Firewall rules. Configure an intrusion detection system (IDS) appliance as the receiver to display the number of hits.
- B. Configure a firewall appliance from the Google Cloud Marketplace. Route all traffic through this appliance, and apply the firewall rules at this layer. Use the firewall appliance to display the number of hits.
- C. Configure Firewall Rules Logging. Use Firewall Insights to display the number of hits.
- D. Configure Firewall Rules Logging. View the logs in Cloud Logging, and create a custom dashboard in Cloud Monitoring to display the number of hits.
正解：C
質問 # 64
You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone.
What should you do?
- A. Update the TTL for the zone.
- B. Disable DNSSEC at your domain registrar.
- C. Transfer ownership of the domain to a new registrar.
- D. Set the zone to the TRANSFER state.
正解：B
解説：
Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone.
Reference: https://cloud.google.com/dns/docs/dnssec-config
質問 # 65
An application development team believes their current logging tool will not meet their needs for their new cloud-based product. They want a better tool to capture errors and help them analyze their historical log data. You want to help them find a solution that meets their needs, what should you do?
- A. Direct them to download and install the Google StackDriver logging agent.
- B. Send them a list of online resources about logging best practices.
- C. Help them define their requirements and assess viable logging tools.
- D. Help them upgrade their current tool to take advantage of any new features.
正解：C
解説：
A and D can be ruled out for them are not general IT good practices. They need your help, not just simply to sell your products, or point them to the crowded resource without explains.
B (Correct Answer) - Help them define their requirements and assess viable logging tools. They know the requirements and the existing tools' problems. While it's true StackDriver Logging and Error Reporting meet all their requirements, they need you to provide expertise to make assessment for new tools, specifically, logging tools that can capture errors and help them analyze their historical log data?
C - Help them upgrade their current tool to take advantage of any new features. They have already used and know those tools' shortcomings. They need your help to find better one. Simply help them upgrade for new features is not enough and may not resolve the problems
質問 # 66
In your Google Cloud organization, you have two folders: Dev and Prod. You want a scalable and consistent way to enforce the following firewall rules for all virtual machines (VMs) with minimal cost:
Port 8080 should always be open for VMs in the projects in the Dev folder.
Any traffic to port 8080 should be denied for all VMs in your projects in the Prod folder.
What should you do?
- A. Create a Shared VPC for the Dev projects and a Shared VPC for the Prod projects. Create a VPC firewall rule to open port 8080 in the Shared VPC for Dev. Create a firewall rule to deny traffic to port 8080 in the Shared VPC for Prod. Deploy VMs to those Shared VPCs.
- B. Create and associate a firewall policy with the Dev folder with a rule to open port 8080. Create and associate a firewall policy with the Prod folder with a rule to deny traffic to port 8080.
- C. In all VPCs for the Dev projects, create a VPC firewall rule to open port 8080. In all VPCs for the Prod projects, create a VPC firewall rule to deny traffic to port 8080.
- D. Use Anthos Config Connector to enforce a security policy to open port 8080 on the Dev VMs and deny traffic to port 8080 on the Prod VMs.
正解：B
質問 # 67
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from your on-premises network using Cloud Interconnect. You must configure access only to Google APIs and services that are supported by VPC Service Controls through hybrid connectivity with a service level agreement (SLA) in place. What should you do?
- A. Add Direct Peering links, and use them for connectivity to Google APIs that use public virtual IP addresses.
- B. Configure the existing Cloud Routers to advertise the Google API's public virtual IP addresses.
- C. Configure the existing Cloud Routers to advertise a default route, and use Cloud NAT to translate traffic from your on-premises network.
- D. Use Private Google Access for on-premises hosts with restricted.googleapis.com virtual IP addresses.
正解：D
質問 # 68
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set request-path to a specific URL used for health checking, and set proxy-header to PROXY_V1.
- B. Set request-path to a specific URL used for health checking, and set host to include a custom host header that identifies the health check.
- C. Set proxy-header to the default value, and set host to include a custom host header that identifies the health check.
- D. Set request-path to a specific URL used for health checking, and set response to a string that the backend service will always return in the response body.
正解：D
解説：
https://cloud.google.com/load-balancing/docs/health-check-concepts#content-based_health_checks
質問 # 69
You recently deployed Compute Engine instances in regions us-west1 and us-east1 in a Virtual Private Cloud (VPC) with default routing configurations. Your company security policy mandates that virtual machines (VMs) must not have public IP addresses attached to them. You need to allow your instances to fetch updates from the internet while preventing external access. What should you do?
- A. Create a firewall rule that allows egress to destination 0.0.0.0/0.
- B. Change the instances' network interface external IP address from None to Ephemeral.
- C. Create a single global Cloud NAT gateway and global Cloud Router in the VPC.
- D. Create a Cloud NAT gateway and Cloud Router in both us-west1 and us-east1.
正解：D
質問 # 70
You have the following routing design. You discover that Compute Engine instances in Subnet-2 in the asia-southeast1 region cannot communicate with compute resources on-premises. What should you do?
- A. Change the VPC dynamic routing mode to Global.
- B. Add a second Border Gateway Protocol (BGP) session to the Cloud Router.
- C. Enable IP forwarding in the asia-southeast1 region.
- D. Configure a custom route advertisement on the Cloud Router.
正解：A
質問 # 71
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with the same ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
* BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?
- A. A firewall is blocking the traffic across the second VPN connection.
- B. BGP sessions are not established between both on-premises routers and the Cloud Router.
- C. One of the VPN sessions is configured incorrectly.
- D. You do not have a load balancer to load-balance the network traffic.
正解：C
解説：
If the VPN logs show a no-proposal-chosen error, this error indicates that Cloud VPN and your peer VPN gateway were unable to agree on a set of ciphers. For IKEv1, the set of ciphers must match exactly. For IKEv2, there must be at least one common cipher proposed by each gateway. Make sure that you use supported ciphers to configure your peer VPN gateway. https://cloud.google.com/network-connectivity/docs/vpn/support/troubleshooting#:~:text=If%20the%20VPN%20logs%20show,of%20ciphers%20must%20match%20exactly.&text=Make%20sure%20that%20you%20use,configure%20your%20peer%20VPN%20gateway.
質問 # 72
You have two Google Cloud projects in a perimeter to prevent data exfiltration. You need to move a third project inside the perimeter; however, the move could negatively impact the existing environment. You need to validate the impact of the change. What should you do?
- A. Modify the existing VPC Service Controls policy to include the new project in dry run mode.
- B. Monitor the Resource Manager audit logs inside the perimeter.
- C. Enable VPC Flow Logs inside the third project, and monitor the logs for negative impact.
- D. Enable Firewall Rules Logging inside the third project.
正解：A
質問 # 73
Your company's Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure:
/fr/video
/en/video
/es/video
/../video
/fr/audio
/en/audio
/es/audio
/../audio
Which solution should you recommend?
- A. Leave the directory structure as-is, create a URL map and leverage a path rule such as \/[a-z]{2}\/video and
\/[a-z]{2}\/audio. - B. Rearrange the directory structure, create a URL map and leverage a path rule such as /video/* and /audio/*.
- C. Rearrange the directory structure, create DNS hostname entries for video and audio and leverage a path rule such as /video/* and /audio/*.
- D. Leave the directory structure as-is, create a URL map and leverage a path rule such as /*/video and /*/ audio.
正解：B
解説：
https://cloud.google.com/load-balancing/docs/url-map#configuring_url_maps Path matcher constraints Path matchers and path rules have the following constraints: A path rule can only include a wildcard character (*) after a forward slash character (/). For example, /videos/* and /videos/hd/* are valid for path rules, but /videos* and /videos/hd* are not. Path rules do not use regular expression or substring matching. For example, path rules for either /videos/hd or /videos/hd/* do not apply to a URL with the path /video/hd-abcd. However, a path rule for /video/* does apply to that path. https://cloud.google.com/load-balancing/docs/url-map-concepts#pm-constraints
質問 # 74
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)
- A. Enable Private Google Access on the VPC.
- B. Create network peering between your VPC and BigQuery.
- C. Enable Private Services Access on the VPC.
- D. Create a Cloud NAT, and route the application traffic via NAT gateway.
- E. Enable Private Google Access on all the subnets.
正解：D、E
解説：
https://cloud.google.com/nat/docs/overview#interaction-pga Specifications https://cloud.google.com/vpc/docs/configure-private-google-access#specifications
質問 # 75
You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?
- A. Add a firewall rule that allows port 443 from the other spoke projects.
- B. Enable Private Google Access on the subnet where the GKE nodes are deployed.
- C. Deploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.
- D. Configure the authorized networks to be the subnet ranges of the other spoke projects.
正解：D
質問 # 76
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from on-premises locations using Cloud Interconnect connections. Your company must be able to send traffic to Cloud Storage only through the Interconnect links while accessing other Google APIs and services over the public internet. What should you do?
- A. Use Private Service Connect to access Cloud Storage, and use the default public domains for all other Google APIs and services.
- B. Use the default public domains for all Google APIs and services.
- C. Use Private Google Access, with restricted.googleapis.com virtual IP addresses for Cloud Storage and private.googleapis.com for all other Google APIs and services.
- D. Use Private Google Access, with private.googleapis.com virtual IP addresses for Cloud Storage and restricted.googleapis.com virtual IP addresses for all other Google APIs and services.
正解：A
質問 # 77
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?
- A. Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
- B. Manually patch some of the instances, and then perform a rolling restart on the instance group.
- C. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
- D. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
正解：C
解説：
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups#starting_a_canary_update
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups
質問 # 78
You work for a multinational enterprise that is moving to GCP.
These are the cloud requirements:
* An on-premises data center located in the United States in Oregon and New York with Dedicated Interconnects connected to Cloud regions us-west1 (primary HQ) and us-east4 (backup)
* Multiple regional offices in Europe and APAC
* Regional data processing is required in europe-west1 and australia-southeast1
* Centralized Network Administration Team
Your security and compliance team requires a virtual inline security appliance to perform L7 inspection for URL filtering. You want to deploy the appliance in us-west1.
What should you do?
- A. * Create 2 VPCs in a Shared VPC Host Project.
* Configure a 2-NIC instance in zone us-west1-a in the Service Project.
* Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.
* Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.
* Deploy the instance.
* Configure the necessary routes and firewall rules to pass traffic through the instance. - B. * Create 2 VPCs in a Shared VPC Host Project.
* Configure a 2-NIC instance in zone us-west1-a in the Host Project.
* Attach NIC0 in VPC #1 us-west1 subnet of the Host Project.
* Attach NIC1 in VPC #2 us-west1 subnet of the Host Project.
* Deploy the instance.
* Configure the necessary routes and firewall rules to pass traffic through the instance. - C. * Create 1 VPC in a Shared VPC Host Project.
* Configure a 2-NIC instance in zone us-west1-a in the Host Project.
* Attach NIC0 in us-west1 subnet of the Host Project.
* Attach NIC1 in us-west1 subnet of the Host Project
* Deploy the instance.
* Configure the necessary routes and firewall rules to pass traffic through the instance. - D. * Create 1 VPC in a Shared VPC Service Project.
* Configure a 2-NIC instance in zone us-west1-a in the Service Project.
* Attach NIC0 in us-west1 subnet of the Service Project.
* Attach NIC1 in us-west1 subnet of the Service Project
* Deploy the instance.
* Configure the necessary routes and firewall rules to pass traffic through the instance.
正解：B
質問 # 79
You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?
- A. GKE Cluster
- B. GKE Pod
- C. GKE Node
- D. GKE Ingress
正解：B
解説：
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig
質問 # 80
You are migrating a three-tier application architecture from on-premises to Google Cloud. As a first step in the migration, you want to create a new Virtual Private Cloud (VPC) with an external HTTP(S) load balancer. This load balancer will forward traffic back to the on-premises compute resources that run the presentation tier. You need to stop malicious traffic from entering your VPC and consuming resources at the edge, so you must configure this policy to filter IP addresses and stop cross-site scripting (XSS) attacks. What should you do?
- A. Create a VPC firewall ruleset, and apply it to all instances in unmanaged instance groups.
- B. Create a Google Cloud Armor policy, and apply it to a backend service that uses an internet network endpoint group (NEG) backend.
- C. Create a hierarchical firewall ruleset, and apply it to the VPC's parent organization resource node.
- D. Create a Google Cloud Armor policy, and apply it to a backend service that uses an unmanaged instance group backend.
正解：B
質問 # 81
You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner.
What should you first?
- A. Create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.
- B. Ask your Interconnect partner to provision a physical connection to Google.
- C. Log in to your partner's portal and request the VLAN attachment there.
- D. Run gcloud compute interconnect attachments partner update <attachment> / -- region <region> --admin-enabled.
正解：B
解説：
Reference:
https://cloudplatform.googleblog.com/2018/06/Partner-Interconnect-now-generally-available.html
質問 # 82
Your company's Google Cloud-deployed, streaming application supports multiple languages. The application development team has asked you how they should support splitting audio and video traffic to different backend Google Cloud storage buckets. They want to use URL maps and minimize operational overhead. They are currently using the following directory structure:
/fr/video
/en/video
/es/video
/../video
/fr/audio
/en/audio
/es/audio
/../audio
Which solution should you recommend?
- A. Leave the directory structure as-is, create a URL map and leverage a path rule such as /*/video and /*/ audio.
- B. Leave the directory structure as-is, create a URL map and leverage a path rule such as \/[a-z]{2}\/video and
\/[a-z]{2}\/audio. - C. Rearrange the directory structure, create DNS hostname entries for video and audio and leverage a path rule such as /video/* and /audio/*.
- D. Rearrange the directory structure, create a URL map and leverage a path rule such as /video/* and /audio/
*.
正解：A
質問 # 83
You want to use Cloud Interconnect to connect your on-premises network to a GCP VPC. You cannot meet Google at one of its point-of-presence (POP) locations, and your on-premises router cannot run a Border Gateway Protocol (BGP) configuration.
Which connectivity model should you use?
- A. Partner Interconnect with a layer 2 partner
- B. Partner Interconnect with a layer 3 partner
- C. Direct Peering
- D. Dedicated Interconnect
正解：D
解説：
Reference:
https://cloud.google.com/interconnect/docs/support/faq
質問 # 84
In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each department has one VPC in its project and wants full control over their network. Neither department intends to recreate its existing computing resources. You want to implement a solution that minimizes cost.
Which two steps should you take? (Choose two.)
- A. Connect the VPCs in project code-dev and data-dev using VPC Network Peering.
- B. Connect both projects using Cloud VPN.
- C. Enable Shared VPC in one project (e. g., code-dev), and make the second project (e. g., data-dev) a service project.
- D. Create a route in the code-dev project to the destination prefixes in project data-dev and use nexthop as the default gateway, and vice versa.
- E. Enable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances in project data-dev, and vice versa.
正解：A、E
質問 # 85
You create a Google Kubernetes Engine private cluster and want to use kubectl to get the status of the pods. In one of your instances you notice the master is not responding, even though the cluster is up and running.
What should you do to solve the problem?
- A. Assign a public IP address to the instance.
- B. Create a route to reach the Master, pointing to the default internet gateway.
- C. Create the appropriate firewall policy in the VPC to allow traffic from Master node IP address to the instance.
- D. Create the appropriate master authorized network entries to allow the instance to communicate to the master.
正解：C
質問 # 86
You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT.
What is the most likely cause of this problem?
- A. An external IP address has been configured on the instance.
- B. You have created static routes that use RFC1918 ranges.
- C. The instance is accessible by a load balancer external IP address.
- D. The instance has been configured with multiple interfaces.
正解：A
解説：
Explanation/Reference: https://www.sovereignsolutionscorp.com/google-cloud-nat/
質問 # 87
......
Professional-Cloud-Network-Engineer問題集と試験テストエンジン：https://www.goshiken.com/Google/Professional-Cloud-Network-Engineer-mondaishu.html
最新版を今すぐ試そうProfessional-Cloud-Network-Engineer練習テスト問題解答：https://drive.google.com/open?id=1b0_JAppIbyIarKw4y0LYLDnvpabtIyy3