[2024年12月10日] 究極のProfessional-Cloud-Network-Engineer準備ガイド！無料最新のGoogle練習テスト問題集
今すぐゲットせよ！高評価Google Professional-Cloud-Network-Engineer試験問題集
Google Professional-Cloud-Network-Engineer試験は、Google Cloudプラットフォームでネットワークアーキテクチャを設計、実装、および管理する際の専門家の能力を評価する認定テストです。この試験は、クラウドコンピューティングのさまざまな役割の認定を提供するGoogle Cloud Certifiedプログラムの一部です。この試験に合格することにより、専門家はクラウドネットワーキングの専門知識を紹介し、Googleクラウドプラットフォームに安全でスケーラブルで信頼性の高いネットワークを実装する能力を実証できます。
試験は、複数選択肢や複数回答式の問題から構成され、2時間の時間制限があります。試験は、Google Cloud Consoleを介して実施され、世界中のどこからでもオンラインで受験できます。試験は、仮想プライベートクラウド（VPC）、クラウドロードバランシング、クラウドCDN、クラウドDNS、クラウドVPNなど、さまざまなネットワークサービスの構成と管理能力をテストするよう設計されています。試験は、ネットワークセキュリティ、ルーティング、トラフィック管理などのトピックもカバーしています。
Google Professional-Cloud-Network-Engineer認定試験は、Google Cloud Technologiesの操作に関心のあるネットワーク専門家向けに設計されています。この認定は、Google Cloudプラットフォームでネットワークソリューションの設計、実装、および管理の経験がある個人を対象としています。この試験では、ネットワーキングの基礎、ネットワークセキュリティ、ネットワークアーキテクチャなど、さまざまなトピックをカバーしています。
質問 # 93
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)
- A. VPC peering
- B. Dedicated Interconnect
- C. Cloud NAT
- D. Shared VPC
- E. Cloud VPN
正解：B、E
解説：
https://cloud.google.com/vpc/docs/vpc
質問 # 94
You have the networking configuration shown in the diagram. A pair of redundant Dedicated Interconnect connections (int-Igal and int-Iga2) terminate on the same Cloud Router The Interconnect connections terminate on two separate on-premises routers. You are advertising the same prefixes from the Border Gateway Protocol (BGP) sessions associated with the Dedicated Interconnect connections. You need to configure one connection as Active for both ingress and egress traffic. If the active Interconnect connection fails, you want the passive Interconnect connection to automatically begin routing all traffic Which two actions should you take to meet this requirement? (Choose Two)
- A. Advertise a lower MED on the passive Interconnect connection from the on-premises router
- B. Configure the advertised route priority as 200 for the BGP session associated With the passive Interconnect connection.
- C. Configure the advertised route priority > 10,200 on the active Interconnect connection.
- D. Advertise a lower MED on the active Interconnect connection from the on-premises router
- E. Configure the advertised route priority as 200 for the BGP session associated Wlth the active Interconnect connection.
正解：D、E
解説：
This answer meets the requirement of configuring one connection as Active for both ingress and egress traffic, and enabling automatic failover to the passive connection in case of failure. The reason is:
The advertised route priority is a value that Cloud Router uses to set the route priority when advertising routes to your on-premises router. The lower the value, the higher the priority1. By setting the advertised route priority as 200 for the active connection, you ensure that it has a higher priority than the passive connection, which has the default value of 1001. This way, your on-premises router will prefer the routes from the active connection over the passive one for ingress traffic.
The MED (Multi-Exit Discriminator) is a value that your on-premises router uses to indicate its preference for receiving traffic from Cloud Router. The lower the value, the higher the preference2. By advertising a lower MED on the active connection from your on-premises router, you ensure that Cloud Router will prefer sending traffic to the active connection over the passive one for egress traffic.
If the active connection fails, Cloud Router will stop receiving routes from it and will start using the routes from the passive connection for egress traffic. Similarly, your on-premises router will stop receiving routes with priority 200 from the active connection and will start using the routes with priority 100 from the passive connection for ingress traffic. This achieves automatic failover without any manual intervention.
Option A is incorrect because setting the advertised route priority > 10,200 on the active connection would deprioritize it globally in your VPC network, which is not what you want1. Option B is incorrect because advertising a lower MED on the passive connection would make Cloud Router prefer sending traffic to it over the active one, which is not what you want2. Option D is incorrect because setting the advertised route priority as 200 for both connections would make them equally preferred by your on-premises router, which is not what you want1.
Reference:
Update the base route priority | Cloud Router | Google Cloud
Configuring BGP sessions | Cloud Router | Google Cloud
質問 # 95
You need to configure a Google Kubernetes Engine (GKE) cluster. The initial deployment should have 5 nodes with the potential to scale to 10 nodes. The maximum number of Pods per node is 8. The number of services could grow from 100 to up to 1024. How should you design the IP schema to optimally meet this requirement?
- A. Configure a /28 primary IP address range for the node IP addresses. Configure a /24 secondary IP range for the Pads. Configure a /22 secondary IP range for the Services.
- B. Configure a /28 primary IP address range for the node IP addresses. Configure a (25 secondary IP range for the Pods. Configure a /22 secondary IP range for the Services.
- C. Configure a /28 primary IP address range for the node IP addresses. Configure a /25 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.
- D. Configure a /28 primary IP address range for the node IP addresses. Configure a /28 secondary IP range for the Pods. Configure a /21 secondary IP range for the Services.
正解：B
質問 # 96
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?
- A. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
- B. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.
- C. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
- D. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
With Shared VPC and IAM controls, you can separate network administration from project administration. This separation helps you implement the principle of least privilege. For example, a centralized network team can administer the network without having any permissions into the participating projects. Similarly, the project admins can manage their project resources without any permissions to manipulate the shared network.
正解：B
質問 # 97
You built a web application with several containerized microservices. You want to run those microservices on Cloud Run. You must also ensure that the services are highly available to your customers with low latency. What should you do?
- A. Deploy the Cloud Run services to multiple availability zones. Create a global TCP load balancer. Add the Cloud Run endpoints to its backend service.
- B. Deploy the Cloud Run services to multiple regions. Configure a round-robin A record in Cloud DNS.
- C. Deploy the Cloud Run services to multiple regions. Create serverless network endpoint groups (NEGs) that point to the services. Create a global HTTPS load balancer, and attach the serverless NEGs as backend services of the load balancer.
- D. Deploy the Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTPS load balancer, and attach the Cloud Endpoints to its backend
正解：C
質問 # 98
Datachamps is an organization resource and it has many projects under it .The company uses BigQuery for data analysis. They want a user named admin-bigquery to be the admin for all BigQuery data across all of the projects under the Datachamps organization . Monitorbigquery is a service account that's responsible for monitoring the size of all the tables across all projects in the Datachamps organization. What predefined roles must be given to admin-bigquery (user) and Monitorbigquery (service account) .
- A. bigquery.admin to admin-bigquery and bigquery.dataOwner to Monitorbigquery service account.
- B. bigquery.connectionAdmin to admin-bigquery and bigquery.dataEditor to Monitoringbigquery service account .
- C. bigquery.user to admin-bigquery and bigquery.dataViewer to Monitorbigquery service
- D. bigquery.admin to admin-bigquery and bigquery.dataViewer to Monitorbigquery service account.
正解：D
解説：
Option B is the Correct choice because, On organization Datachamps add admin-bigquery to the predefined role bigquery.admin this provides permissions to manage all resources across the project and manage all data across the project, and can cancel jobs from other users running across the project.. Add Monitorbigquery to the predefined role bigquery.dataViewer ,when applied at the project or organization level, this role can also enumerate all datasets in the project and this the appropriate role to fulfil the objective of monitoring tables across all projects .
質問 # 99
You are using a 10-Gbps direct peering connection to Google together with the gsutil tool to upload files to Cloud Storage buckets from on-premises servers. The on-premises servers are
100 milliseconds away from the Google peering point. You notice that your uploads are not using the full 10-Gbps bandwidth available to you. You want to optimize the bandwidth utilization of the connection.
What should you do on your on-premises servers?
- A. Remove the -m flag from the gsutil command to enable single-threaded transfers.
- B. Use the perfdiag parameter in your gsutil command to enable faster performance: gsutil perfdiag gs://[BUCKET NAME].
- C. Tune TCP parameters on the on-premises servers.
- D. Compress files using utilities like tar to reduce the size of data being sent.
正解：B
解説：
https://cloud.google.com/solutions/transferring-big-data-sets-to-gcp
質問 # 100
You are configuring a new HTTP application that will be exposed externally behind both IPv4 and IPv6 virtual IP addresses, using ports 80, 8080, and 443. You will have backends in two regions: us-west1 and us-east1. You want to serve the content with the lowest-possible latency while ensuring high availability and autoscaling, and create native content-based rules using the HTTP hostname and request path. The IP addresses of the clients that connect to the load balancer need to be visible to the backends. Which configuration should you use?
- A. Use External HTTP(S) Load Balancing with URL Maps and an X-Forwarded-For header
- B. Use External HTTP(S) Load Balancing with URL Maps and custom headers
- C. Use Network Load Balancing
- D. Use TCP Proxy Load Balancing with PROXY protocol enabled
正解：A
質問 # 101
You deployed a hub-and-spoke architecture in your Google Cloud environment that uses VPC Network Peering to connect the spokes to the hub. For security reasons, you deployed a private Google Kubernetes Engine (GKE) cluster in one of the spoke projects with a private endpoint for the control plane. You configured authorized networks to be the subnet range where the GKE nodes are deployed. When you attempt to reach the GKE control plane from a different spoke project, you cannot access it. You need to allow access to the GKE control plane from the other spoke projects. What should you do?
- A. Deploy a proxy in the spoke project where the GKE nodes are deployed and connect to the control plane through the proxy.
- B. Enable Private Google Access on the subnet where the GKE nodes are deployed.
- C. Add a firewall rule that allows port 443 from the other spoke projects.
- D. Configure the authorized networks to be the subnet ranges of the other spoke projects.
正解：D
質問 # 102
You are planning to use Terraform to deploy the Google Cloud infrastructure for your company The design must meet the following requirements
* Each Google Cloud project must represent an Internal project that your team Will work on
* After an internal project is finished, the infrastructure must be deleted
* Each Internal project must have Its own Google Cloud project owner to manage the Google Cloud resources-
* You have 10-100 projects deployed at a time,
While you are writing the Terraform code, you need to ensure that the deployment IS Simple, and the code IS reusable With centralized management What should you doo
- A. Create a Single Project and Single VPC for each internal project
- B. Create a Shared VPC and service project for each Internal project
- C. Create a Single pt0Ject and additional VPCs for each Internal project
- D. Create a single Shared VPC and attach each Google Cloud project as a service project
正解：D
解説：
The correct answer is C. Create a single Shared VPC and attach each Google Cloud project as a service project.
This answer is based on the following facts:
A Shared VPC allows you to share one or more VPC networks across multiple Google Cloud projects1. This simplifies the deployment and management of the network infrastructure, as you only need to create and maintain one VPC network for all your internal projects.
A Shared VPC consists of a host project that owns the VPC network and one or more service projects that use the VPC network2. You can attach and detach service projects as needed, depending on the lifecycle of your internal projects. You can also delete service projects without affecting the host project or other service projects.
A Shared VPC allows you to delegate administrative roles to different project owners3. You can grant the Shared VPC Admin role to the owner of the host project, who can manage the VPC network and its subnets. You can also grant the Service Project Admin role to the owners of the service projects, who can manage the Google Cloud resources in their own projects.
The other options are not correct because:
Option A is not suitable. Creating a single project and additional VPCs for each internal project will increase the complexity and cost of the network infrastructure. You will need to create and maintain multiple VPC networks, firewall rules, routes, and VPN tunnels. You will also have a limit on the number of VPC networks per project4.
Option B is not feasible. Creating a single project and single VPC for each internal project will not meet the requirement of having separate project owners for each internal project. You will have only one project owner who can manage all the Google Cloud resources in the same project.
Option D is not optimal. Creating a Shared VPC and service project for each internal project will not meet the requirement of having a simple and reusable code with centralized management. You will need to create and maintain multiple Shared VPCs, which will increase the complexity and cost of the network infrastructure. You will also have more Terraform code to write and manage for each Shared VPC.
質問 # 103
Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?
- A. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.
- B. Assign members of the networking team the compute.networkAdmin role.
- C. Assign members of the networking team the compute.networkUser role.
- D. Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.
正解：B
解説：
https://cloud.google.com/compute/docs/access/iam
質問 # 104
You need to create the technical architecture for hybrid connectivity from your data center to Google Cloud This will be managed by a partner. You want to follow Google-recommended practices for production-level applications. What should you do?
- A. Configure two Partner Interconnect connections in one metro and two connections in another metro Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure global dynamic routing on the VPC
- B. Ask the partner to install two security appliances in the data center. Configure one VPN connection from each of these devices to Google Cloud, and ensure that the VPN devices on-premises are in separate racks on separate power and cooling systems.
- C. Configure two Partner Interconnect connections in one metro and two connections in another metro. Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in one region and two VLAN attachments in another region, and configure regional dynamic routing on the VPC.
- D. Configure two Partner Interconnect connections in one metropolitan area (metro). Make sure the Interconnect connections are placed in different metro edge availability domains. Configure two VLAN attachments in a single region, and configure regional dynamic routing on the VPC
正解：C
解説：
"Google's recommended practices for production-level applications" and then see overview of these 2 pages- https://cloud.google.com/network-connectivity/docs/interconnect/tutorials/production-level-overview and https://cloud.google.com/network-connectivity/docs/interconnect/tutorials/non-critical-overview .
質問 # 105
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)
- A. Create a Cloud NAT, and route the application traffic via NAT gateway.
- B. Enable Private Google Access on all the subnets.
- C. Enable Private Services Access on the VPC.
- D. Create network peering between your VPC and BigQuery.
- E. Enable Private Google Access on the VPC.
正解：A、B
解説：
https://cloud.google.com/nat/docs/overview#interaction-pga Specifications https://cloud.google.com/vpc/docs/configure-private-google-access#specifications
質問 # 106
You work for a university that is migrating to GCP.
These are the cloud requirements:
- On-premises connectivity with 10 Gbps
- Lowest latency access to the cloud
- Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects.
You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?
- A. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
- B. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
- C. Use standalone projects, and deploy the VLAN attachments in the individual projects.
Connect the VLAN attachment to the standalone projects' Interconnects. - D. Use Shared VPC, and deploy the VLAN attachments in the service projects.
Connect the VLAN attachment to the Shared VPC's host project.
正解：D
質問 # 107
Your software team is developing an on-premises web application that requires direct connectivity to Compute Engine Instances in GCP using the RFC 1918 address space. You want to choose a connectivity solution from your on-premises environment to GCP, given these specifications:
* Your ISP is a Google Partner Interconnect provider.
* Your on-premises VPN device's internet uplink and downlink speeds are 10 Gbps.
* A test VPN connection between your on-premises gateway and GCP is performing at a maximum speed of 500 Mbps due to packet losses.
* Most of the data transfer will be from GCP to the on-premises environment.
* The application can burst up to 1.5 Gbps during peak transfers over the Interconnect.
* Cost and the complexity of the solution should be minimal.
How should you provision the connectivity solution?
- A. Use network compression over your VPN to increase the amount of data you can send over your VPN.
- B. Provision a Dedicated Interconnect instead of a VPN.
- C. Provision a Partner Interconnect through your ISP.
- D. Create multiple VPN tunnels to account for the packet losses, and increase bandwidth using ECMP.
正解：D
質問 # 108
You have a data workflow which consists of data ingestion layer, data transformation layer, data analytics layer and data storage layer. You are looking for a service that would ease the tasks of creating, scheduling, monitoring and managing workflows without dealing with the management of the infrastructure .Please select the right service that would fulfil the requirement.
- A. Istio
- B. Apache Airflow
- C. Cloud Composer
- D. Stackdriver
正解：C
解説：
Option B is the Correct choice because, Cloud Composer is a managed Apache Airflow service that helps you create, schedule, monitor and manage workflows.
Option A is Incorrect choice because, you could install Apache Airflow on a VM instance but it would mean you will have to manage the infrastructure.
Option C is Incorrect because, Istio an open platform to connect, monitor, and secure microservices.
Option D is Incorrect because, Stackdriver is a monitoring and management for services, containers, applications, and infrastructure.
質問 # 109
Your company just completed the acquisition of Altostrat (a current GCP customer). Each company has a separate organization in GCP and has implemented a custom DNS solution. Each organization will retain its current domain and host names until after a full transition and architectural review is done in one year. These are the assumptions for both GCP environments.
* Each organization has enabled full connectivity between all of its projects by using Shared VPC.
* Both organizations strictly use the 10.0.0.0/8 address space for their instances, except for bastion hosts (for accessing the instances) and load balancers for serving web traffic.
* There are no prefix overlaps between the two organizations.
* Both organizations already have firewall rules that allow all inbound and outbound traffic from the 10.0.0.0/8 address space.
* Neither organization has Interconnects to their on-premises environment.
You want to integrate networking and DNS infrastructure of both organizations as quickly as possible and with minimal downtime.
Which two steps should you take? (Choose two.)
- A. Create a third organization with a new host project, and attach all projects from your company and Altostrat to it using shared VPC
- B. Use Cloud DNS to create A records of all VMs and resources across all projects in both organizations.
- C. Set up some variant of DNS forwarding and zone transfers in each organization.
- D. Provision Cloud Interconnect to connect both organizations together.
- E. Connect VPCs in both organizations using Cloud VPN together with Cloud Router.
正解：B、D
質問 # 110
You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)
- A. Turn on Private Services Access at the VPC level.
- B. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.
- C. Turn on Private Google Access at the VPC level.
- D. Turn on Private Google Access at the subnet level.
- E. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
正解：A、B
解説：
Explanation/Reference: https://cloud.google.com/vpc/docs/private-access-options
質問 # 111
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?
- A. Grant the compute.instanceAdminto your user account.
- B. Grant the read-onlyprivilege to the service account for the Cloud Storage bucket.
- C. Grant the cloud-platformprivilege to the service account for the Cloud Storage bucket.
- D. Grant the iam.serviceAccountUserto your user account.
正解：D
解説：
Explanation/Reference: https://cloud.google.com/compute/docs/access/iam
質問 # 112
......
合格率取得する秘訣はProfessional-Cloud-Network-Engineer認定試験エンジンPDF：https://jp.fast2test.com/Professional-Cloud-Network-Engineer-premium-file.html
Professional-Cloud-Network-Engineer試験問題集で合格できるには更新されたテスト問題集：https://drive.google.com/open?id=18zNn1VlrdIUyoxq2K__5vpl57LVFFHhO