Google Associate-Cloud-Engineer 問題集

質問 1：
Your company is moving its entire workload to Compute Engine. Some servers should be accessible through the Internet, and other servers should only be accessible over the internal network. All servers need to be able to talk to each other over specific ports and protocols. The current on-premises network relies on a demilitarized zone (DMZ) for the public servers and a Local Area Network (LAN) for the private servers.
You need to design the networking infrastructure on
Google Cloud to match these requirements. What should you do?
A. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
B. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
C. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
D. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
(You deployed an application on a managed instance group in Compute Engine. The application accepts Transmission Control Protocol (TCP) traffic on port 389 and requires you to preserve the IP address of the client who is making a request. You want to expose the application to the internet by using a load balancer.
What should you do?)
A. Expose the application by using an internal passthrough Network Load Balancer.
B. Expose the application by using an external passthrough Network Load Balancer.
C. Expose the application by using a regional external proxy Network Load Balancer.
D. Expose the application by using a global external proxy Network Load Balancer.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
You just installed the Google Cloud CLI on your new corporate laptop. You need to list the existing instances of your company on Google Cloud. What must you do before you run the gcloud compute instances list command?
Choose 2 answers
A. Run gcloud auth login, enter your login credentials in the dialog window, and paste the received login token to gcloud CLI.
B. Run gcloud config set project $my_project to set the default project for gcloud CLI.
C. Create a Google Cloud service account, and download the service account key. Place the key file in a folder on your machine where gcloud CLI can find it.
D. Download your Cloud Identity user account key. Place the key file in a folder on your machine where gcloud CLI can find it.
E. Run gcloud config set compute/zone $my_zone to set the default zone for gcloud CLI.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
You are migrating a production-critical on-premises application that requires 96 vCPUs to perform its task.
You want to make sure the application runs in a similar environment on GCP. What should you do?
A. When creating the VM, use Intel Skylake as the CPU platform.
B. Create the VM using Compute Engine default settings. Use gcloud to modify the running instance to have 96 vCPUs.
C. Start the VM using Compute Engine default settings, and adjust as you go based on Rightsizing Recommendations.
D. When creating the VM, use machine type n1-standard-96.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
You need to create a custom VPC with a single subnet. The subnet's range must be as large as possible.
Which range should you use?
A. 10.0.0.0/8
B. .00.0.0/0
C. 172.16.0.0/12
D. 192.168.0.0/16
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A colleague handed over a Google Cloud project for you to maintain. As part of a security checkup, you want to review who has been granted the Project Owner role. What should you do?
A. In the Google Cloud console, validate which SSH keys have been stored as project-wide keys.
B. Enable Audit logs on the IAM & admin page for all resources, and validate the results.
C. Navigate to Identity-Aware Proxy and check the permissions for these resources.
D. Use the gcloud projects get-iam-policy command to view the current role assignments.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process to enforce short-lived service account credentials in your company. You have the following requirements:
* All service accounts that require a key should be created in a centralized project called pj-sa.
* Service account keys should only be valid for one day.
You need a Google-recommended solution that minimizes cost. What should you do?
A. Enforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. Enforce an org policy constraint denying service account key creation with an exception on pj-sa.
B. Implement a Kubernetes Cronjob to rotate all service account keys periodically. Disable attachment ofservice accounts to resources in all projects with an exception to pj-sa.
C. Implement a Cloud Run job to rotate all service account keys periodically in pj-sa. Enforce an org policy to deny service account key creation with an exception to pj-sa.
D. Enforce a DENY org policy constraint over the lifetime of service account keys for 24 hours. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 8：
You have a web application deployed as a managed instance group. You have a new version of the application to gradually deploy. Your web application is currently receiving live web traffic. You want to ensure that the available capacity does not decrease during the deployment. What should you do?
A. Create a new managed instance group with an updated instance template. Add the group to the backend service for the load balancer. When all instances in the new managed instance group are healthy, delete the old managed instance group.
B. Perform a rolling-action start-update with maxSurge set to 1 and maxUnavailable set to 0.
C. Perform a rolling-action start-update with maxSurge set to 0 and maxUnavailable set to 1.
D. Create a new instance template with the new application version. Update the existing managed instance group with the new instance template. Delete the instances in the managed instance group to allow the managed instance group to recreate the instance using the new instance template.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 9：
Your application development team has created Docker images for an application that will be deployed on Google Cloud. Your team does not want to manage the infrastructure associated with this application. You need to ensure that the application can scale automatically as it gains popularity. What should you do?
A. Upload Docker images to Artifact Registry, and deploy the application on Google Kubernetes Engine usingStandard mode.
B. Upload Docker images to the Cloud Storage, and deploy the application on Google Kubernetes Engine usingStandard mode.
C. Upload Docker images to Artifact Registry, and deploy the application on Cloud Run.
D. Create an Instance template with the container image, and deploy a Managed Instance Group withAutoscaling.
正解：C