[2023年11月18日]GoShiken Professional-Cloud-Network-Engineer問題集でGoogle Cloud Platform合格確定させる練習問題集
Google Professional-Cloud-Network-Engineer実際にある問題とブレーン問題集
Google Professional-Cloud-Network-Engineer試験は、クラウドネットワークの設計、実装、および管理に関与している専門家にとって貴重な認定です。 Google Cloudプラットフォームのセキュリティを最適化し、コストを削減し、セキュリティを増やすために必要な知識とスキルを提供します。さらに、Google Cloud認定を受けていることで、新しいキャリアの機会を開き、クラウドコンピューティング業界の専門家の収益の可能性を高めることができます。
Google Professional-Cloud-Network-Enginer認定試験は、Google Cloudプラットフォームでネットワークソリューションの設計、実装、および管理の専門知識を実証したいITプロフェッショナルにとって重要な認定です。クラウドベースのネットワークソリューションに対する需要の増加に伴い、この認定は、ITの専門家が競争の激しい雇用市場で際立ってキャリアを促進するのに役立ちます。
Google Professional-Cloud-Network-Engineer認定試験は、Google Cloud Networking Technologiesを深く理解する必要がある挑戦的な試験です。候補者は、ネットワーキングの概念に強力な基盤を持ち、Googleクラウド製品とサービスに精通している必要があります。この試験は、Google Cloudプラットフォームで安全でスケーラブルで非常に利用可能なネットワークソリューションを設計および実装する候補者の能力をテストするように設計されています。この認定により、専門家はネットワークエンジニアリングの専門知識を実証し、業界でのスキルの認識を獲得できます。
質問 # 93
You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT.
What is the most likely cause of this problem?
- A. The instance has been configured with multiple interfaces.
- B. An external IP address has been configured on the instance.
- C. The instance is accessible by a load balancer external IP address.
- D. You have created static routes that use RFC1918 ranges.
正解：B
解説：
Explanation/Reference: https://www.sovereignsolutionscorp.com/google-cloud-nat/
質問 # 94
Your organization has a single project that contains multiple Virtual Private Clouds (VPCs). You need to secure API access to your Cloud Storage buckets and BigQuery datasets by allowing API access only from resources in your corporate public networks. What should you do?
- A. Create an access context policy that allows your VPC and corporate public network IP ranges, and then attach the policy to Cloud Storage and BigQuery.
- B. Create a firewall rule to block API access to Cloud Storage and BigQuery from unauthorized networks.
- C. Create a VPC Service Controls perimeter for your project with an access context policy that allows your corporate public network IP ranges.
- D. Create a VPC Service Controls perimeter for each VPC with an access context policy that allows your corporate public network IP ranges.
正解：C
質問 # 95
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
* Flow logs are enabled for the VPC subnet, and all firewall rules are set to log.
* The subnetwork logs are not excluded from Stackdriver.
* The instance that is hosting the application can communicate outside the subnet.
* Other instances within the subnet can communicate outside the subnet.
* The external resource initiates communication.
What is the most likely cause of the missing log lines?
- A. The traffic is not matching the expected ingress rule.
- B. The traffic is matching the expected egress rule.
- C. The traffic is matching the expected ingress rule.
- D. The traffic is not matching the expected egress rule.
正解：A
質問 # 96
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with the same ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
* BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?
- A. One of the VPN sessions is configured incorrectly.
- B. You do not have a load balancer to load-balance the network traffic.
- C. BGP sessions are not established between both on-premises routers and the Cloud Router.
- D. A firewall is blocking the traffic across the second VPN connection.
正解：A
解説：
If the VPN logs show a no-proposal-chosen error, this error indicates that Cloud VPN and your peer VPN gateway were unable to agree on a set of ciphers. For IKEv1, the set of ciphers must match exactly. For IKEv2, there must be at least one common cipher proposed by each gateway. Make sure that you use supported ciphers to configure your peer VPN gateway. https://cloud.google.com/network-connectivity/docs/vpn/support/troubleshooting#:~:text=If%20the%20VPN%20logs%20show,of%20ciphers%20must%20match%20exactly.&text=Make%20sure%20that%20you%20use,configure%20your%20peer%20VPN%20gateway.
質問 # 97
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
GetIamPolicy() via REST API
- A. setIamPolicy() via REST API
- B. role roles/editor
- C. role roles/editor
gcloud projects add-iam-policy-binding Sprojectname --member user:Susername -- - D. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --
- E. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
正解：B、E
解説：
Explanation/Reference: https://cloud.google.com/iam/docs/granting-changing-revoking-access
質問 # 98
You have enabled HTTP(S) load balancing for your application, and your application developers have reported that HTTP(S) requests are not being distributed correctly to your Compute Engine Virtual Machine instances. You want to find data about how the request are being distributed.
Which two methods can accomplish this? (Choose two.)
- A. In Stackdriver Error Reporting, look for any unacknowledged errors for the Cloud Load Balancers service.
- B. In Stackdriver Monitoring, select Resources > Metrics Explorer and search for https/request_bytes_count metric.
- C. In Stackdriver Monitoring, create a new dashboard and track the https/backend_request_count metric for the load balancer.
- D. In Stackdriver Monitoring, select Resources > Google Cloud Load Balancers and review the Key Metrics graphs in the dashboard.
- E. On the Load Balancer details page of the GCP Console, click on the Monitoring tab, select your backend service, and look at the graphs.
正解：D、E
質問 # 99
You are developing an HTTP API hosted on a Compute Engine virtual machine instance that must be invoked only by multiple clients within the same Virtual Private Cloud (VPC). You want clients to be able to get the IP address of the service. What should you do?
- A. Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule. Clients should use this IP address to connect to the service.
- B. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url https://[INSTANCE_NAME].[ZONE].c.[PROJECT_ID].internal/.
- C. Reserve a static external IP address and assign it to an HTTP(S) load balancing service's forwarding rule. Then, define an A record in Cloud DNS. Clients should use the name of the A record to connect to the service.
- D. Ensure that clients use Compute Engine internal DNS by connecting to the instance name with the url https://[API_NAME]/[API_VERSION]/.
正解：C
質問 # 100
You have created an HTTP(S) load balanced service. You need to verify that your backend instances are responding properly.
How should you configure the health check?
- A. Set proxy-header to the default value, and set hostto include a custom host header that identifies the health check.
- B. Set request-path to a specific URL used for health checking, and set hostto include a custom host header that identifies the health check.
- C. Set request-pathto a specific URL used for health checking, and set proxy-headerto PROXY_V1.
- D. Set request-path to a specific URL used for health checking, and set responseto a string that the backend service will always return in the response body.
正解：B
解説：
Explanation/Reference: https://cloud.google.com/load-balancing/docs/health-checks
質問 # 101
You work for a university that is migrating to GCP.
These are the cloud requirements:
* On-premises connectivity with 10 Gbps
* Lowest latency access to the cloud
* Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
- B. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
- C. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
- D. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
正解：A
解説：
https://cloud.google.com/interconnect/docs/how-to/dedicated/using-interconnects-other-projects Using Cloud Interconnect with Shared VPC You can use Shared VPC to share your VLAN attachment in a project with other VPC networks. Choosing Shared VPC is preferable if you need to create many projects and would like to prevent individual project owners from managing their connectivity back to your on-premises network. In this scenario, the host project contains a common Shared VPC network usable by VMs in service projects. Because VMs in the service projects use this network, Service Project Admins don't need to create other VLAN attachments or Cloud Routers in the service projects. In this scenario, you must create VLAN attachments and Cloud Routers for a Cloud Interconnect connection only in the Shared VPC host project. The combination of a VLAN attachment and its associated Cloud Router are unique to a given Shared VPC network. https://cloud.google.com/network-connectivity/docs/interconnect/how-to/enabling-multiple-networks-access-same-attachment#using_with
https://cloud.google.com/vpc/docs/shared-vpc
質問 # 102
You have configured a service on Google Cloud that connects to an on-premises service via a Dedicated Interconnect. Users are reporting recent connectivity issues. You need to determine whether the traffic is being dropped because of firewall rules or a routing decision. What should you do?
- A. Configure VPC Flow Logs. Review the logs by filtering on the source and destination.
- B. Use Network Intelligence Center Network Topology to check the traffic flow, and replay the traffic from the time period when the connectivity issue occurred.
- C. Configure a Compute Engine instance on the same VPC as the service running on Google Cloud to run a traceroute targeted at the on-premises service.
- D. Use the Network Intelligence Center Connectivity Tests to test the connectivity between the VPC and the on-premises network.
正解：B
質問 # 103
You are using the gcloud command line tool to create a new custom role in a project by coping a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?
- A. Add the resourcemanager.projects.setIamPolicy permission, and try again.
- B. Try again with a different role with a new name but the same permissions.
- C. Remove the resourcemanager.projects.list permission, and try again.
- D. Add the resourcemanager.projects.get permission, and try again.
正解：C
解説：
Reference:
https://cloud.google.com/iam/docs/understanding-custom-roles
質問 # 104
You are designing a hub-and-spoke network architecture for your company's cloud-based environment. You need to make sure that all spokes are peered with the hub. The spokes must use the hub's virtual appliance for internet access.
The virtual appliance is configured in high-availability mode with two instances using an internal load balancer with IP address 10.0.0.5. What should you do?
- A. Create two default routes in the hub VPC that point to the next hop instances of the virtual appliances.
Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.
Export the custom routes in the hub. Import the custom routes in the spokes. - B. Create a default route in the hub VPC that points to IP address 10.0.0.5.
Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.
Export the custom routes in the hub. Import the custom routes in the spokes.
Delete the default internet gateway route of the spokes. - C. Create a default route in the hub VPC that points to IP address 10.0.0.5.
Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.
Export the custom routes in the hub.
Import the custom routes in the spokes. - D. Create a default route in the hub VPC that points to IP address 10.0.0.5.
Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that is tagged only to the appliances with a next hop of the default internet gateway.
Create a new route in the spoke VPC that points to IP address 10.0.0.5.
正解：B
質問 # 105
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)
- A. Shared VPC
- B. VPC peering
- C. Cloud VPN
- D. Dedicated Interconnect
- E. Cloud NAT
正解：C、D
解説：
https://cloud.google.com/vpc/docs/vpc
質問 # 106
You have provisioned a Partner Interconnect connection to extend connectivity from your on-premises data center to Google Cloud. You need to configure a Cloud Router and create a VLAN attachment to connect to resources inside your VPC. You need to configure an Autonomous System number (ASN) to use with the associated Cloud Router and create the VLAN attachment.
What should you do?
- A. Use a 2-byte private ASN 64512-65535.
- B. Use a 4-byte private ASN 4200000000-4294967294.
- C. Use a public Google ASN 15169.
- D. Use a public Google ASN 16550.
正解：A
質問 # 107
You are designing a Google Kubernetes Engine (GKE) cluster for your organization. The current cluster size is expected to host 10 nodes, with 20 Pods per node and 150 services. Because of the migration of new services over the next 2 years, there is a planned growth for 100 nodes, 200 Pods per node, and 1500 services. You want to use VPC-native clusters with alias IP ranges, while minimizing address consumption.
How should you design this topology?
- A. Use gcloud container clusters create [CLUSTER NAME]--enable-ip-alias to create a VPC-native cluster.
- B. Create a subnet of size/28 with 2 secondary ranges of: /24 for Pods and /24 for Services. Create a VPC-native cluster and specify those ranges. When the services are ready to be deployed, resize the subnets.
- C. Create a subnet of size/25 with 2 secondary ranges of: /17 for Pods and /21 for Services. Create a VPC-native cluster and specify those ranges.
- D. Use gcloud container clusters create [CLUSTER NAME] to create a VPC-native cluster.
正解：B
質問 # 108
......
最新Professional-Cloud-Network-Engineer合格保証 試験問題集でには正確で最新な 問題：https://www.goshiken.com/Google/Professional-Cloud-Network-Engineer-mondaishu.html
合格させるProfessional-Cloud-Network-Engineer試験には最新なProfessional-Cloud-Network-Engineer試験問題集PDF2023：https://drive.google.com/open?id=1reSdeEyf3-ZWmUyI8XTsDNIQeroMT69F