Professional-Cloud-Network-Engineer実際の問題解答PDFには100%カバー率リアル試験問題 [Q34-Q52]

Professional-Cloud-Network-Engineer実際の問題解答PDFには100%カバー率リアル試験問題

Professional-Cloud-Network-Engineer試験問題解答

質問 # 34
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?

A. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
B. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
C. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
D. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.

正解：C

解説：
VPC Network Peering enables you to peer VPC networks so that workloads in different VPC networks can communicate in private RFC 1918 space. Traffic stays within Google's network and doesn't traverse the public internet.

質問 # 35
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?

A. Using the new instance template, perform a rolling update across all instances in the instance group. Verify the new feature once the rollout completes.
B. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template. Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
C. Deploy a new instance group and canary the updated template in that group. Verify the new feature in the new canary instance group, and then update the original instance group.
D. Manually patch some of the instances, and then perform a rolling restart on the instance group.

正解：B

解説：
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups#starting_a_canary_update
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups

質問 # 36
You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules.
Always allow Secure Shell (SSH) from your corporate IP address.
Restrict SSH access from all other IP addresses.
There are multiple projects and VPCs in your Google Cloud organization. You need to ensure that other VPC firewall rules cannot bypass the security team's requirements. What should you do?

A. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0.
Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 1.
B. Configure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1.
Configure a VPC firewall rule to deny TCP port 22 for all IP addresses with priority 0.
C. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 0.
Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 1.
D. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your corporate IP address with priority 1 Configure a hierarchical firewall policy to the organization node to deny TCP port 22 for all IP addresses with priority 0.

正解：C

質問 # 37
Your organization has approximately 100 teams that need to manage their own environments. A central team must manage the network. You need to design a landing zone that provides separate projects for each team. You must also make sure the solution can scale. What should you do?

A. Configure Policy-based Routing for each team.
B. Configure a Shared VPC, and create a VPC network in the host project.
C. Configure a Shared VPC, and create a VPC network in the service project.
D. Configure VPC Network Peering, and peer one of the VPCs to the service project.

正解：B

解説：
A Shared VPC allows the central networking team to manage the VPC network while individual teams can manage their resources in service projects. This solution provides scalability by allowing for multiple service projects under the same Shared VPC, and it allows the network team to maintain control over the network resources.

質問 # 38
The security team has disabled external SSH access into production virtual machines in GCP.
The operations team needs to remotely manage the VMs and other resources. What can they do?

A. Configure a VPN connection to GCP to allow SSH access to the cloud VMs.
B. Grant the operations team access to use Google Cloud Shell.
C. Develop a new access request process that grants temporary SSH access to cloud VMs when an operations engineer needs to perform a task.
D. Have the development team build an API service that allows the operations team to execute specific remote procedure calls to accomplish their tasks.

正解：B

解説：
Grant the operations team access to use Google Cloud Shell.
B (Correct Answer) - Grant the operations engineers access to use Google Cloud Shell.
All the engineer asked is remote access the VMs just like using SSH, so if the machines still have an external IP address, the engineers can access them via SSH using Google Cloud Shell.
This is easies effective way to meet the requirements. All other answers are possible options that might require more setup than worthwhile for your needs.

質問 # 39
Your organization wants to deploy HA VPN over Cloud Interconnect to ensure encryption in transit over the Cloud Interconnect connections. You have created a Cloud Router and two encrypted VLAN attachments that have a 5 Gbps capacity and a BGP configuration. The BGP sessions are operational. You need to complete the deployment of the HA VPN over Cloud Interconnect. What should you do?

A. Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Create a new dedicated HA VPN Cloud Router peer VPN gateway resources and HA VPN tunnels.
B. Enable MACsec on Partner Interconnect.
C. Enable MACsec for Cloud Interconnect on the VLAN attachments.
D. Create an HA VPN gateway and associate the gateway with your two encrypted VLAN attachments. Configure the HA VPN Cloud Router, peer VPN gateway resources, and HA VPN tunnels. Use the same Cloud Router used for the Cloud Interconnect tier.

正解：D

解説：
For secure traffic over Cloud Interconnect, you configure an HA VPN gateway to work with existing VLAN attachments and use the same Cloud Router. This setup integrates seamlessly, leveraging the established BGP sessions for VPN tunnel configurations.

質問 # 40
You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your organization requires using the least privilege possible.
What should you do?

A. Grant the read-only privilege to the service account for the Cloud Storage bucket.
B. Grant the cloud-platform privilege to the service account for the Cloud Storage bucket.
C. Grant the compute.instanceAdmin to your user account.
D. Grant the iam.serviceAccountUser to your user account.

正解：A

質問 # 41
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?

A. Service Project Admin privileges from the Shared VPC Admin.
B. Organization Admin privileges from the Organization Admin.
C. Security Admin privileges from the Shared VPC Admin.
D. Shared VPC Admin privileges from the Organization Admin.

正解：C

解説：
A Shared VPC Admin can define a Security Admin by granting an IAM member the Security Admin (compute.securityAdmin) role to the host project. Security Admins manage firewall rules and SSL certificates.

質問 # 42
Your company's web server administrator is migrating on-premises backend servers for an application to GCP.
Libraries and configurations differ significantly across these backend servers. The migration to GCP will be lift- and-shift, and all requests to the servers will be served by a single network load balancer frontend. You want to use a GCP-native solution when possible.
How should you deploy this service in GCP?

A. Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.
B. Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal- priority static routes to the backend servers.
C. Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.
D. Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.

正解：C

解説：
Explanation/Reference: https://cloud.google.com/compute/docs/instance-groups/adding-an-instance-group-to-a-load- balancer

質問 # 43
You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. Connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights into what is occurring within Google Cloud. What should you do?

A. Enable and review Cloud Logging on your Cloud NAT gateway. Look for logs with errors matching the destination IP address of the public SaaS provider.
B. Create a Connectivity Test by using TCP, the source IP address of your test VM, and the destination IP address of the public SaaS provider. Review the live data plane analysis and take the next steps based on the test results.
C. Enable the Firewall Insights API. Set the deny rule insights observation period to one day. Review the insights to assure there are no firewall rules denying traffic.
D. Enable and review Cloud Logging for Cloud Armor. Look for logs with errors matching the destination IP address of the public SaaS provider.

正解：B

解説：
Creating a Connectivity Test using TCP in Network Intelligence Center allows you to simulate the connection to the public SaaS provider and receive real-time data plane analysis. This will help determine whether there are any issues with the network path for the specific TCP connection.

質問 # 44
You have the following routing design. You discover that Compute Engine instances in Subnet-2 in the asia-southeast1 region cannot communicate with compute resources on-premises. What should you do?

A. Add a second Border Gateway Protocol (BGP) session to the Cloud Router.
B. Enable IP forwarding in the asia-southeast1 region.
C. Configure a custom route advertisement on the Cloud Router.
D. Change the VPC dynamic routing mode to Global.

正解：D

質問 # 45
You recently deployed two network virtual appliances in us-central1. Your network appliances provide connectivity to your on-premises network, 10.0.0.0/8. You need to configure the routing for your Virtual Private Cloud (VPC). Your design must meet the following requirements:
All access to your on-premises network must go through the network virtual appliances.
Allow on-premises access in the event of a single network virtual appliance failure.
Both network virtual appliances must be used simultaneously.
Which method should you use to accomplish this?

A. Configure an internal HTTP(S) load balancer with the two network virtual appliances as backends. Configure a route for 10.0.0.0/8 with the internal HTTP(S) load balancer as the next hop.
B. Configure an internal TCP/UDP load balancer with the two network virtual appliances as backends. Configure a route for 10.0.0.0/8 with the internal load balancer as the next hop.
C. Configure two routes for 10.0.0.0/8 with different priorities, each pointing to separate network virtual appliances.
D. Configure a network load balancer for the two network virtual appliances. Configure a route for 10.0.0.0/8 with the network load balancer as the next hop.

正解：A

質問 # 46
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?

A. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
B. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
C. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
D. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.

正解：C

質問 # 47
Your organization is deploying a single project for 3 separate departments. Two of these departments require network connectivity between each other, but the third department should remain in isolation. Your design should create separate network administrative domains between these departments. You want to minimize operational overhead.
How should you design the topology?

A. Create 3 separate VPCs, and use VPC peering to establish connectivity between the two appropriate VPCs.
B. Create a single project, and deploy specific firewall rules. Use network tags to isolate access between the departments.
C. Create 3 separate VPCs, and use Cloud VPN to establish connectivity between the two appropriate VPCs.
D. Create a Shared VPC Host Project and the respective Service Projects for each of the 3 separate departments.

正解：D

解説：
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
With Shared VPC and IAM controls, you can separate network administration from project administration. This separation helps you implement the principle of least privilege. For example, a centralized network team can administer the network without having any permissions into the participating projects. Similarly, the project admins can manage their project resources without any permissions to manipulate the shared network.

質問 # 48
Your company has separate Virtual Private Cloud (VPC) networks in a single region for two departments: Sales and Finance. The Sales department's VPC network already has connectivity to on-premises locations using HA VPN, and you have confirmed that the subnet ranges do not overlap. You plan to peer both VPC networks to use the same HA tunnels for on-premises connectivity, while providing internet connectivity for the Google Cloud workloads through Cloud NAT. Internet access from the on-premises locations should not flow through Google Cloud. You need to propagate all routes between the Finance department and on-premises locations. What should you do?

A. Peer the two VPCs, and use Cloud Router's custom route advertisements to announce the peered VPC network ranges to the on-premises locations.
B. Peer the two VPCs. Configure VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network. Use Cloud Router's custom route advertisements to announce a default route to the on-premises locations.
C. Peer the two VPCs, and use the default configuration for the Cloud Routers.
D. Peer the two VPCs. Configure VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network. Use Cloud Router's custom route advertisements to announce the peered VPC network ranges to the on-premises locations.

正解：C

質問 # 49
In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet.
What should you do?

A. Move instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-A's network. Configure the appropriate routes to force traffic through to instance-A.
B. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag.
C. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A.
D. Delete the system-generated subnet route and create a specific route to instance-B with a tag applied to instance-A.

正解：C

質問 # 50
You have enabled HTTP(S) load balancing for your application, and your application developers have reported that HTTP(S) requests are not being distributed correctly to your Compute Engine Virtual Machine instances. You want to find data about how the request are being distributed.
Which two methods can accomplish this? (Choose two.)

A. In Stackdriver Monitoring, create a new dashboard and track the https/backend_request_count metric for the load balancer.
B. In Stackdriver Error Reporting, look for any unacknowledged errors for the Cloud Load Balancers service.
C. In Stackdriver Monitoring, select Resources > Google Cloud Load Balancers and review the Key Metrics graphs in the dashboard.
D. In Stackdriver Monitoring, select Resources > Metrics Explorer and search for https/request_bytes_count metric.
E. On the Load Balancer details page of the GCP Console, click on the Monitoring tab, select your backend service, and look at the graphs.

正解：A、E

質問 # 51
You have an application that is running in a managed instance group. Your development team has released an updated instance template which contains a new feature which was not heavily tested. You want to minimize impact to users if there is a bug in the new template.
How should you update your instances?

A. Deploy a new instance group and canary the updated template in that group.
Verify the new feature in the new canary instance group, and then update the original instance group.
B. Using the new instance template, perform a rolling update across all instances in the instance group.
Verify the new feature once the rollout completes.
C. Perform a canary update by starting a rolling update and specifying a target size for your instances to receive the new template.
Verify the new feature on the canary instances, and then roll forward to the rest of the instances.
D. Manually patch some of the instances, and then perform a rolling restart on the instance group.

正解：A

解説：
https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances

質問 # 52
......

Professional-Cloud-Network-Engineer試験練習テスト問題：https://jp.fast2test.com/Professional-Cloud-Network-Engineer-premium-file.html

合格させるProfessional-Cloud-Network-Engineer試験情報と無料練習テスト：https://drive.google.com/open?id=12poOAN9VW22yALF9-M5OlZvu1fL9s5hE