最新的Google Professional-Cloud-Network-Engineer免費考試真題

問題1

You recently deployed Compute Engine instances in regions us-west1 and us-east1 in a Virtual Private Cloud (VPC) with default routing configurations. Your company security policy mandates that virtual machines (VMs) must not have public IP addresses attached to them. You need to allow your instances to fetch updates from the internet while preventing external access. What should you do?

A. Create a Cloud NAT gateway and Cloud Router in both us-west1 and us-east1.

B. Change the instances' network interface external IP address from None to Ephemeral.

C. Create a single global Cloud NAT gateway and global Cloud Router in the VPC.

D. Create a firewall rule that allows egress to destination 0.0.0.0/0.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題2

You are using the gcloud command line tool to create a new custom role in a project by coping a predefined role. You receive this error message:
INVALID_ARGUMENT: Permission resourcemanager.projects.list is not valid What should you do?

A. Try again with a different role with a new name but the same permissions.

B. Remove the resourcemanager.projects.list permission, and try again.

C. Add the resourcemanager.projects.get permission, and try again.

D. Add the resourcemanager.projects.setIamPolicy permission, and try again.

正確答案: B

說明：（僅 Fast2test 成員可見）

問題3

You want to use Partner Interconnect to connect your on-premises network with your VPC. You already have an Interconnect partner.
What should you first?

A. Create a Partner Interconnect type VLAN attachment in the GCP Console and retrieve the pairing key.

B. Log in to your partner's portal and request the VLAN attachment there.

C. Run gcloud compute interconnect attachments partner update <attachment> / -- region <region> -
-admin-enabled.

D. Ask your Interconnect partner to provision a physical connection to Google.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題4

Your organization requires that all SMTP traffic to your cloud environment is blocked, except for traffic that originates from your corporate network. Your organization also requires that only specific VPCs across your Google Cloud projects will allow SMTP access from your corporate network. You need to configure a security policy that will enable this connectivity. What should you do?

A. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
2. Configure an egress hierarchical firewall rule with priority 10010 specifying the source of your corporate network as TCP port 25 and the goto_next action.
3. Associate the hierarchical firewall policy at the organization level.
4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.

B. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the allow action.
2. Associate the hierarchical firewall policy at the organization level.
3. Configure firewall policy rules to deny TCP port 25 in the firewall policies associated with the respective VPCs that do not require that access.

C. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the source of your corporate network, TCP port 25, and the goto_next action.
2. Configure an ingress hierarchical firewall rule with priority 10010 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
3. Associate the hierarchical firewall policy at the organization level.
4. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.

D. 1. Configure an ingress hierarchical firewall rule with priority 10000 specifying the 0.0.0.0/0 source, TCP port 25, and the deny action.
2. Associate the hierarchical firewall policy at the organization level.
3. Configure firewall policy rules allowing TCP port 25 in the firewall policies associated with the respective VPCs that require that access.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題5

You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed.
During troubleshooting you find:
- Flow logs are enabled for the VPC subnet, and all firewall rules are
set to log.
- The subnetwork logs are not excluded from Stackdriver.
- The instance that is hosting the application can communicate outside
the subnet.
- Other instances within the subnet can communicate outside the subnet.
- The external resource initiates communication.
What is the most likely cause of the missing log lines?

A. The traffic is not matching the expected egress rule.

B. The traffic is not matching the expected ingress rule.

C. The traffic is matching the expected egress rule.

D. The traffic is matching the expected ingress rule.

正確答案: B

說明：（僅 Fast2test 成員可見）

問題6

You are implementing hybrid connectivity between your company's data center and Google Cloud. You've already deployed redundant Dedicated Interconnect connections, and are now deploying VLAN attachments in us-central1. You want to use an active/passive approach, where interconnect-1 is active and interconnect-2 is a passive backup. You need to deploy a Cloud Router to enable BGP connectivity. You want to follow Google-recommended practices. What should you do?

A. 1. Configure the primary and secondary interconnects of the BGP sessions on the Cloud Router with priority 100 and ASN 4200000001.
2. Configure the on-premises ASN as 4200000010.
3. Disable the BGP session on the on-premises router for the secondary interconnect-2.

B. 1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0 and ASN
65101.
2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200 and ASN 65102.
3. Configure the on-premises ASN as 65000.

C. 1. Configure the primary interconnect-1 BGP session on the Cloud Router with priority 0.
2. Configure the secondary interconnect-2 BGP session on the Cloud Router with priority 200.
3. Configure both Google-side BGP ASNs as 65100.
4. Configure the on-premises ASN as 65000.

D. 1. Configure the primary and secondary interconnects of the BGP sessions on the Cloud Router with priority 100 and ASN 16550.
2. Configure the on-premises ASN as 65001 for primary interconnect-1.
3. Configure the on-premises ASN as 65002 for secondary interconnect-2.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題7

Your company has a security team that manages firewalls and SSL certificates. It also has a networking team that manages the networking resources. The networking team needs to be able to read firewall rules, but should not be able to create, modify, or delete them.
How should you set up permissions for the networking team?

A. Assign members of the networking team the compute.networkViewer role, and add the compute.networks.use permission.

B. Assign members of the networking team a custom role with only the compute.networks.* and the compute.firewalls.list permissions.

C. Assign members of the networking team the compute.networkAdmin role.

D. Assign members of the networking team the compute.networkUser role.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題8

Your company has separate Virtual Private Cloud (VPC) networks in a single region for two departments: Sales and Finance. The Sales department's VPC network already has connectivity to on-premises locations using HA VPN, and you have confirmed that the subnet ranges do not overlap. You plan to peer both VPC networks to use the same HA tunnels for on-premises connectivity, while providing internet connectivity for the Google Cloud workloads through Cloud NAT. Internet access from the on-premises locations should not flow through Google Cloud. You need to propagate all routes between the Finance department and on-premises locations. What should you do?

A. Peer the two VPCs. Configure VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network.
Use Cloud Router's custom route advertisements to announce the peered VPC network ranges to the on-premises locations.

B. Peer the two VPCs. Configure VPC Network Peering to export custom routes from Sales and import custom routes on Finance's VPC network.
Use Cloud Router's custom route advertisements to announce a default route to the on-premises locations.

C. Peer the two VPCs, and use Cloud Router's custom route advertisements to announce the peered VPC network ranges to the on-premises locations.

D. Peer the two VPCs, and use the default configuration for the Cloud Routers.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題9

Your organization has an on-premises data center. You need to provide connectivity from the on- premises data center to Google Cloud. Bandwidth must be at least 1 Gbps, and the traffic must not traverse the internet. What should you do?

A. Configure Dedicated Interconnect by creating a VLAN attachment, activate the connection, and submit the pairing key to your service provider.

B. Configure HA VPN by using high availability gateways and tunnels.

C. Configure Partner Interconnect by creating a VLAN attachment, submit the pairing key to your service provider, and activate the connection.

D. Configure Cross-Cloud Interconnect by creating a VLAN attachment, activate the connection, and then submit the pairing key to your service provider.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題10

You have recently taken over responsibility for your organization's Google Cloud network security configurations. You want to review your Cloud Next Generation Firewall (Cloud NGFW) configurations to ensure that there are no rules allowing ingress traffic to your VMs and services from the internet. You want to avoid manual work. What should you do?

A. Export all your Cloud NGFW rules into a CSV file and search for 0.0.0.0/0.

B. Run Connectivity Tests from multiple external sources to confirm that traffic is not allowed to ingress to your most critical services in Google Cloud.

C. Use Firewall Insights, and enable insights for Overly permissive rules.

D. Review Network Analyzer insights on the VPC network category.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題11

Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments. What should you do?

A. Create two hierarchical firewall policies per department's folder with two rules in each: a high- priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.

B. Create a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.

C. Create a VPC firewall rule in each VPC to block traffic from any source, with priority 0.

D. Create two hierarchical firewall policies per department's folder with two rules in each: a high- priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題12

You are migrating a three-tier application architecture from on-premises to Google Cloud. As a first step in the migration, you want to create a new Virtual Private Cloud (VPC) with an external HTTP(S) load balancer. This load balancer will forward traffic back to the on-premises compute resources that run the presentation tier. You need to stop malicious traffic from entering your VPC and consuming resources at the edge, so you must configure this policy to filter IP addresses and stop cross-site scripting (XSS) attacks. What should you do?

A. Create a hierarchical firewall ruleset, and apply it to the VPC's parent organization resource node.

B. Create a Google Cloud Armor policy, and apply it to a backend service that uses an unmanaged instance group backend.

C. Create a Google Cloud Armor policy, and apply it to a backend service that uses an internet network endpoint group (NEG) backend.

D. Create a VPC firewall ruleset, and apply it to all instances in unmanaged instance groups.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題13

You have provisioned a Partner Interconnect connection to extend connectivity from your on- premises data center to Google Cloud. You need to configure a Cloud Router and create a VLAN attachment to connect to resources inside your VPC. You need to configure an Autonomous System number (ASN) to use with the associated Cloud Router and create the VLAN attachment.
What should you do?

A. Use a public Google ASN 16550.

B. Use a 2-byte private ASN 64512-65535.

C. Use a 4-byte private ASN 4200000000-4294967294.

D. Use a public Google ASN 15169.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題14

You want to apply a new Cloud Armor policy to an application that is deployed in Google Kubernetes Engine (GKE). You want to find out which target to use for your Cloud Armor policy.
Which GKE resource should you use?

A. GKE Cluster

B. GKE Node

C. GKE Pod

D. GKE Ingress

正確答案: D

說明：（僅 Fast2test 成員可見）

最新的Google Cloud Certified - Professional Cloud Network Engineer - Professional-Cloud-Network-Engineer免費考試真題

聯系我們

站內鏈接

最新更新