Professional-Cloud-Network-Engineer試験問題集を使って一日でGoogle Cloud Platform試験合格目指す（最新の172解答)
Professional-Cloud-Network-Engineer試験正確な問題集、学習ノートと理論
Google Professional-Cloud-Network-Engineer認定を取得するには、候補者は、ネットワークアーキテクチャ、ネットワークセキュリティ、ネットワーク最適化、ネットワークトラブルシューティングなど、幅広いトピックをカバーする厳格な試験に合格する必要があります。この試験は、複数選択とシナリオベースの質問で構成されており、候補者はそれを完了するのに2時間あります。
Google Professional-Cloud-Network-Engineer 認定試験は、Google Cloud Platform (GCP) ネットワークソリューションの設計、実装、および管理の専門知識を証明したい人々を対象とした専門的な認定試験です。この認定は、エンタープライズグレードのネットワーキングソリューションを設計および管理する責任を持つネットワークエンジニア、ネットワーク管理者、およびその他の IT 専門家を対象としています。
質問 # 63
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments.
* Each organization has enabled full connectivity between all of its projects by using Shared VPC.
* Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.
* There are no prefix overlaps between the two organizations.
* Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.
* Neither organization has Interconnects to their on-premises environment.
You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.
Which two steps should you take? (Choose two.)
- A. Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
- B. Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC
- C. Set up some variant of DNS forwarding and zone transfers in each organization.
- D. Provision Cloud Interconnect to connect both organizations together.
- E. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
正解：A、D
質問 # 64
You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)
- A. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.
- B. GetIamPolicy() via REST API
- C. setIamPolicy() via REST API
- D. gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
- E. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
正解：A、D
質問 # 65
You suspect that one of the virtual machines (VMs) in your default Virtual Private Cloud (VPC) is under a denial-of-service attack. You need to analyze the incoming traffic for the VM to understand where the traffic is coming from. What should you do?
- A. Enable VPC Flow Logs for the subnet. Analyze the logs and get the source IP addresses from the connection field.
- B. Enable VPC Flow Logs for the VPC. Analyze the logs and get the source IP addresses from the src_location field.
- C. Enable Data Access audit logs of the VPC. Analyze the logs and get the source IP addresses from the subnetworks.get field.
- D. Enable Data Access audit logs of the subnet. Analyze the logs and get the source IP addresses from the networks.get field.
正解：A
質問 # 66
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- B. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- C. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
- D. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
正解：A
解説：
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
With Shared VPC and IAM controls, you can separate network administration from project administration.
This separation helps you implement the principle of least privilege. For example, a centralized network team can administer the network without having any permissions into the participating projects. Similarly, the project admins can manage their project resources without any permissions to manipulate the shared network.
https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
質問 # 67
You are increasing your usage of Cloud VPN between on-premises and GCP, and you want to support more traffic than a single tunnel can handle. You want to increase the available bandwidth using Cloud VPN.
What should you do?
- A. Create two VPN tunnels on the same Cloud VPN gateway that point to the same destination VPN gateway IP address.
- B. Add a second Cloud VPN gateway in a different region than the existing VPN gateway.
Create a new tunnel on the second Cloud VPN gateway that forwards the same IP range, but points to the existing on-premises VPN gateway IP address. - C. Add a second on-premises VPN gateway with a different public IP address.
Create a second tunnel on the existing Cloud VPN gateway that forwards the same IP range, but points at the new on-premises gateway IP. - D. Double the MTU on your on-premises VPN gateway from 1460 bytes to 2920 bytes.
正解：A
解説：
https://cloud.google.com/vpn/docs/concepts/classic-topologies
質問 # 68
You need to ensure your personal SSH key works on every instance in your project. You want to accomplish this as efficiently as possible.
What should you do?
- A. Create a custom Google Compute Engine image with your public ssh key embedded.
- B. Use gcloud compute sshto automatically copy your public ssh key to the instance.
- C. Upload your public ssh key to each instance Metadata.
- D. Upload your public ssh key to the project Metadata.
正解：D
解説：
Explanation/Reference: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys
質問 # 69
Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with on-premises connectivity already in place. You are deploying a new application using Google Kubernetes Engine (GKE), which must be accessible only from the same VPC network and on-premises locations. You must ensure that the GKE control plane is exposed to a predefined list of on-premises subnets through private connectivity only. What should you do?
- A. Create a GKE public cluster. Configure authorized networks to specify the desired on-premises subnets.
- B. Create a GKE private cluster with a public endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers.
- C. Create a GKE private cluster with a private endpoint for the control plane. Configure authorized networks to specify the desired on-premises subnets.
- D. Create a GKE private cluster with a private endpoint for the control plane. Configure VPC Networking Peering export/import routes and custom route advertisements on the Cloud Routers. Configure authorized networks to specify the desired on-premises subnets.
正解：C
質問 # 70
Your on-premises data center has 2 routers connected to your Google Cloud environment through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with a unique ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* BGP sessions are established between both on-premises routers and the Cloud Router.
* Only 1 of the on-premises router's routes are being added to the routing table.
What is the most likely cause of this problem?
- A. A firewall is blocking the traffic across the second VPN connection.
- B. The ASNs being used on the on-premises routers are different.
- C. You do not have a load balancer to load-balance the network traffic.
- D. The on-premises routers are configured with the same routes.
正解：B
質問 # 71
You need to define an address plan for a future new GKE cluster in your VPC. This will be a VPC native cluster, and the default Pod IP range allocation will be used. You must pre-provision all the needed VPC subnets and their respective IP address ranges before cluster creation. The cluster will initially have a single node, but it will be scaled to a maximum of three nodes if necessary. You want to allocate the minimum number of Pod IP addresses.
Which subnet mask should you use for the Pod IP address range?
- A. /21
- B. /23
- C. /22
- D. /25
正解：D
解説：
Reference:
https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips
質問 # 72
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
With Shared VPC and IAM controls, you can separate network administration from project administration. This separation helps you implement the principle of least privilege. For example, a centralized network team can administer the network without having any permissions into the participating projects. Similarly, the project admins can manage their project resources without any permissions to manipulate the shared network. - B. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- C. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- D. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
正解：B
質問 # 73
Refer to the exhibit.
You have the following firewall ruleset applied to all instances in your Virtual Private Cloud (VPC):
You need to update the firewall rule to add the following rule to the ruleset:
You are using a new user account. You must assign the appropriate identity and Access Management (IAM) user roles to this new user account before updating the firewall rule. The new user account must be able to apply the update and view firewall logs. What should you do?
- A. Assign the compute.securityAdmin and logging.viewer rule to the new user account. Apply the new firewall rule with a priority of 50.
- B. Assign the compute.orgSecurityPolicyAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
- C. Assign the compute.orgSecurityPolicyAdmin and logging.viewer role to the new user account. Apply the new firewall rule with a priority of 50.
- D. Assign the compute.securityAdmin and logging.bucketWriter role to the new user account. Apply the new firewall rule with a priority of 150.
正解：A
質問 # 74
You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial-of-service and application layer (layer 7) attacks. What should you do?
- A. Configure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level.
- B. Configure VPC firewall rules to protect the Compute Engine instances against distributed denial-of-service attacks.
- C. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.
- D. Configure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.
正解：B
質問 # 75
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- B. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- C. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
- D. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
正解：A
解説：
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
With Shared VPC and IAM controls, you can separate network administration from project administration. This separation helps you implement the principle of least privilege. For example, a centralized network team can administer the network without having any permissions into the participating projects. Similarly, the project admins can manage their project resources without any permissions to manipulate the shared network.
Reference: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
質問 # 76
You work for one of the biggest digital media company in USA .The company management has decided to move 90 TB of backups and archival data to Google Cloud. They are looking for long term cost effective archival storage for disaster recovery in Google Cloud . Please select the right solution.
- A. Transfer Appliance and Coldline storage
- B. gsutil and Cloud storage
- C. Storage Transfer and Nearline storage
- D. Transfer Appliance and Nearline storage
正解：A
解説：
Option B is the correct choice because ,Transfer Appliance is the best choice moving large volume of data and since they are looking for long term cost effective disaster recovery solution , coldline is the best option.
Option A is Incorrect because Storage Transfer is used to import online data into Cloud Storage .
Your online data source can be an Amazon Simple Storage Service (Amazon S3) bucket, an HTTP/HTTPS location, or a Cloud Storage bucket Option C is Incorrect because , gsutil isn't recommended for large volume of data transfer ,It will take a very long time for data transfer depending on the bandwidth.
Option D is Incorrect because , Coldline is a more cost effective archival storage for disaster recovery.
質問 # 77
Your on-premises data center has 2 routers connected to your GCP through a VPN on each router. All applications are working correctly; however, all of the traffic is passing across a single VPN instead of being load-balanced across the 2 connections as desired.
During troubleshooting you find:
* Each on-premises router is configured with the same ASN.
* Each on-premises router is configured with the same routes and priorities.
* Both on-premises routers are configured with a VPN connected to a single Cloud Router.
* The VPN logs have no-proposal-chosen lines when the VPNs are connecting.
* BGP session is not established between one on-premises router and the Cloud Router.
What is the most likely cause of this problem?
- A. A firewall is blocking the traffic across the second VPN connection.
- B. You do not have a load balancer to load-balance the network traffic.
- C. BGP sessions are not established between both on-premises routers and the Cloud Router.
- D. One of the VPN sessions is configured incorrectly.
正解：B
質問 # 78
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?
- A. Assign members of the networking team the compute.networkUser role.
- B. Assign members of the networking team the compute.networkAdmin role.
- C. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.
- D. Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
正解：B
質問 # 79
You built a web application with several containerized microservices. You want to run those microservices on Cloud Run. You must also ensure that the services are highly available to your customers with low latency. What should you do?
- A. Deploy the Cloud Run services to multiple regions. Configure a round-robin A record in Cloud DNS.
- B. Deploy the Cloud Run services to multiple regions. Create serverless network endpoint groups (NEGs) that point to the services. Create a global HTTPS load balancer, and attach the serverless NEGs as backend services of the load balancer.
- C. Deploy the Cloud Run services to multiple availability zones. Create a global TCP load balancer. Add the Cloud Run endpoints to its backend service.
- D. Deploy the Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTPS load balancer, and attach the Cloud Endpoints to its backend
正解：B
質問 # 80
......
Professional-Cloud-Network-Engineer問題集PDFで最速合格希望Professional-Cloud-Network-Engineer：https://www.goshiken.com/Google/Professional-Cloud-Network-Engineer-mondaishu.html
100% 高得点合格保証Professional-Cloud-Network-Engineer無制限172解答：https://drive.google.com/open?id=1HLot6h_9cFyu07IgfhQ_msGIZL1pM8HC