Google Professional-Cloud-Network-Engineer 問題集

質問 1：
You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial-of-service and application layer (layer 7) attacks. What should you do?
A. Configure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.
B. Configure VPC firewall rules to protect the Compute Engine instances against distributed denial-of- service attacks.
C. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.
D. Configure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level.
正解：B

質問 2：
Your end users are located in close proximity to us-east1 and europe-west1. Their workloads need to communicate with each other. You want to minimize cost and increase network efficiency.
How should you design this topology?
A. Create 2 VPCs, each with their own region and individual subnets. Use external IP addresses on the instances to establish connectivity between these regions.
B. Create 1 VPC with 2 regional subnets. Create a global load balancer to establish connectivity between the regions.
C. Create 2 VPCs, each with their own regions and individual subnets. Create 2 VPN gateways to establish connectivity between these regions.
D. Create 1 VPC with 2 regional subnets. Deploy workloads in these subnets and have them communicate using private RFC1918 IP addresses.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Your organization has approximately 100 teams that need to manage their own environments. A central team must manage the network. You need to design a landing zone that provides separate projects for each team.
You must also make sure the solution can scale. What should you do?
A. Configure VPC Network Peering, and peer one of the VPCs to the service project.
B. Configure Policy-based Routing for each team.
C. Configure a Shared VPC, and create a VPC network in the host project.
D. Configure a Shared VPC, and create a VPC network in the service project.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible, To ease the transition, you decided to use the same architecture as your on-premises network' a hub-and-spoke model. Your on-premises architecture consists of over 50 spokes.
Each spoke does not have connectivity to the other spokes, and all traffic IS sent through the hub for security reasons. You need to ensure that the Google Cloud architecture matches your on-premises architecture. You want to implement a solution that minimizes management overhead and cost, and uses default networking quotas and limits. What should you do?
A. Connect all the spokes to the hub With Cloud VPN. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes
B. Connect all the spokes to the hub with VPC Network Peering.
C. Connect all the spokes to the hub with Cloud VPN.
D. Connect all the spokes to the hub with VPC Network Peering. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
You are troubleshooting an issue where your organization's Cloud HA VPN is disconnected from your on- premises router for approximately 10 seconds before reestablishing the tunnel. The issue regularly occurs every few hours. You notice that the HA VPN logs show an entry of Received SA_DELETE when this issue occurs. You need to resolve this issue and prevent future VPN downtime from impacting your production applications. What should you do?
A. Q Update the on-premises router's Phase 1 and Phase 2 lifetime IKE parameters to match the values in the Cloud HA VPN documentation.
B. Q Update the on-premises router's Diffie-Hellman groups and cipher proposal list to match the values in the Cloud HA VPN documentation.
C. Q Update the on-premises router's BGP router ID to reflect the link-local IP peer address assigned by Cloud Router.
D. Q Update the pre-shared key (PSK) of the on-premises router's VPN tunnel configuration to match the PSK of the Cloud HA VPN.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Question:
You are designing the architecture for your organization so that clients can connect to certain Google APIs.
Your plan must include a way to connect to Cloud Storage and BigQuery. You also need to ensure the traffic does not traverse the internet. You want your solution to be cloud-first and require the least amount of configuration steps. What should you do?
A. Configure Private Google Access on the subnet resource. Create a default route to the internet.
B. Configure a global Secure Web Proxy and remove the default route to the internet.
C. Configure Private Google Access on the VPC resource. Create a default route to the internet.
D. Configure Cloud NAT and remove the default route to the internet.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 7：
You created a VPC network named Retail in auto mode. You want to create a VPC network named Distribution and peer it with the Retail VPC.
How should you configure the Distribution VPC?
A. Create the Distribution VPC in custom mode. Use the CIDR range 10.128.0.0/9. Create the necessary subnets, and then peer them via network peering.
B. Create the Distribution VPC in custom mode. Use the CIDR range 10.0.0.0/9. Create the necessary subnets, and then peer them via network peering.
C. Create the Distribution VPC in auto mode. Peer both the VPCs via network peering.
D. Rename the default VPC as "Distribution" and peer it via network peering.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 8：
You are the Organization Admin for your company. One of your engineers is responsible for setting up multiple host projects across multiple folders and sharing subnets with service projects. You need to enable the engineer's Identity and Access Management (IAM) configuration to complete their task in the fewest number of steps. What should you do?
A. Set up the engineer with Compute Shared VPC Admin IAM role at the folder level.
B. Set up the engineer with Compute Shared VPC Admin IAM role at the organization level.
C. Set up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the folder level.
D. Set up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the organization level.
正解：B