PCNE Practice Test 21 — 15 Questions

Question 1

Your company has a Dedicated Interconnect between on-premises and Google Cloud. After a maintenance window, some routes are missing from the on-premises side. On the Cloud Router, you see that the BGP session status is 'ESTABLISHED'. However, the route table on the on-premises router does not contain any of the VPC subnets. What is the most likely cause?

Accepted Answer

The Cloud Router has an empty 'Advertised IP ranges' list. The BGP session is 'ESTABLISHED', confirming that the TCP connection and BGP peering are working correctly. However, the on-premises router is not receiving any VPC subnet routes because the Cloud Router's 'Advertised IP ranges' list is empty, meaning it is not advertising any routes to the peer. This is a common misconfiguration where the Cloud Router is configured to use custom route advertisements but the list of prefixes to advertise is left blank.

Answer

The Cloud Router is not configured to advertise any custom routes

Answer

MD5 authentication is enabled but passwords differ

Answer

BGP configuration mismatch on the on-premises router

Question 2

What is the maximum number of VLAN attachments that can be configured on a single 10 Gbps Dedicated Interconnect connection?

Accepted Answer

8. A single 10 Gbps Dedicated Interconnect connection supports a maximum of 8 VLAN attachments. This limit is defined by Google Cloud's interconnect architecture, where each VLAN attachment consumes a portion of the 10 Gbps bandwidth and is mapped to a unique VLAN ID. The 8-attachment cap ensures predictable performance and avoids oversubscription on the physical link.

Answer

16

Answer

4

Answer

2

Question 3

Company A and Company B both have networks in Google Cloud. They want to connect their VPCs using VPC peering, but they have overlapping IP addresses. How can they resolve this?

Accepted Answer

Use Cloud VPN to establish connectivity between the VPCs, as VPC peering cannot handle overlapping IPs.. VPC peering does not support overlapping IP ranges. The only option from the list that can handle overlapping IPs is Cloud VPN with network address translation or filtering.

Answer

Configure Private Service Connect to connect the VPCs.

Answer

Configure VPC peering with custom route exchange to exclude the overlapping subnets.

Answer

Use Dedicated Interconnect to connect the VPCs through a central router.

Question 4

A customer is configuring a route-based IPsec VPN tunnel to Google Cloud. On their on-premises router, they must specify traffic selectors (proxy IDs). What should they set the local and remote traffic selectors to?

Accepted Answer

Set both local and remote traffic selectors to 0.0.0.0/0.. Option A is correct: For route-based VPN, traffic selectors should be set to 0.0.0.0/0 (any) because route-based tunnels use routing tables to determine which traffic is sent through the tunnel, rather than policy-based selectors. Option B is wrong because policy-based VPN uses specific selectors, but the question specifies route-based. Option C is wrong because IKE version does not affect traffic selectors. Option D is wrong.

Answer

Configure IKE version to match.

Answer

Set local to on-prem subnet and remote to VPC subnet.

Answer

Use policy-based VPN instead.

Question 5

Which TWO are necessary components for setting up Dedicated Interconnect? (Choose two.)

Accepted Answer

A Cloud Router in the same region as the VLAN attachment. A Cloud Router is required in the same region as the VLAN attachment to enable dynamic routing (BGP) between your on-premises network and Google Cloud VPC. The VLAN attachment must be mapped to a VPC to define which VPC network the interconnect circuit connects to, allowing traffic to flow between your on-premises network and Google Cloud resources.

Answer

A Cloud VPN tunnel for management traffic

Answer

A QoS policy to ensure bandwidth guarantee

Answer

Two physical interconnect connections for redundancy

Question 6

Which TWO situations are most appropriate for using Partner Interconnect instead of Dedicated Interconnect?

Accepted Answer

When data center space is limited and you cannot host a Google edge router. Option B and D are correct. B: When colocation space is limited, partner can provide connectivity. D: When using a service provider that already connects to Google. A: High SLA is better with Dedicated. C: Bandwidth over 10 Gbps is better with Dedicated. E: HA VPN already provides encryption.

Answer

When you need IPSec encryption

Answer

When 99.99% SLA is required

Answer

When bandwidth requirements exceed 10 Gbps per connection

Question 7

Refer to the exhibit. A BGP session between a Cloud Router and an on-premises router is not establishing. The Cloud Router logs show 'BGP_OPEN_MSG_ERROR: unsupported capability'. What is the most likely issue?

Accepted Answer

The on-premises router is attempting to negotiate a BGP capability that Cloud Router does not support, such as 4-byte ASNs or IPv6 unicast.. The error message 'BGP_OPEN_MSG_ERROR: unsupported capability' indicates that during the BGP OPEN message exchange, the on-premises router advertised a BGP capability (such as 4-byte ASN support or IPv6 unicast address family) that the Cloud Router does not support. This causes the Cloud Router to reject the OPEN message and reset the session. Option D correctly identifies this mismatch in negotiated capabilities.

Answer

The on-premises router cannot reach the Cloud Router's BGP IP.

Answer

The BGP session is stuck in the Connect state due to firewall blocking TCP port 179.

Answer

The BGP ASN configured on the Cloud Router doesn't match the peer.

Question 8

A company has two HA VPN tunnels from on-premises to Google Cloud using two separate Cloud Routers for redundancy. The on-premises network uses BGP and advertises a default route to Google Cloud. The company wants to ensure that traffic from Google Cloud to on-premises prefers the primary Cloud Router over the secondary. Which configuration should be applied?

Accepted Answer

Set a higher LOCAL_PREF on the primary Cloud Router for the default route.. Option C is correct because LOCAL_PREF is a well-known mandatory BGP attribute that is used to influence outbound traffic from an AS. By setting a higher LOCAL_PREF on the primary Cloud Router for the default route, Google Cloud will prefer that path for traffic destined to on-premises, as LOCAL_PREF is evaluated before other attributes like AS_PATH and MED.

Answer

Set the primary Cloud Router's BGP IP as the next-hop for all routes on the secondary.

Answer

Set a lower MED on the primary Cloud Router's BGP session for the default route advertisement.

Answer

Set a shorter AS_PATH on the primary Cloud Router's BGP session.

Question 9

Refer to the exhibit. An engineer is troubleshooting a dual-tunnel HA VPN. The BGP session on one interface is established (State/PfxRcd 1) but the other is stuck in Active state. What can cause this?

Accepted Answer

The on-premises router does not have a BGP configuration for the second peer IP address (169.254.x.x).. In a dual-tunnel HA VPN, each tunnel uses a separate BGP session with its own peer IP address (typically from the 169.254.x.x link-local range). If the on-premises router only has a BGP neighbor statement for the first peer IP, it will ignore incoming BGP packets from the second peer. The Cloud Router sees the session stuck in Active state because it is sending BGP OPEN messages but never receiving a response, as the on-premises router is not listening on that IP.

Answer

The Cloud Router is using the same BGP identifier for both sessions, causing a conflict.

Answer

The on-premises router is configured with BGP MD5 authentication that only matches the first peer.

Answer

The MTU on the second tunnel is not matching between the two ends.

Question 10

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

Accepted Answer

Configure active-active BGP with multiple sessions using different ASNs.. Option B is correct because active-active BGP with multiple sessions using different ASNs allows each tunnel to be treated as an independent path. If one tunnel fails, BGP withdraws the routes learned over that session, and traffic automatically shifts to the remaining tunnels without manual intervention. This configuration provides true automatic failover and load balancing, which is a best practice for HA VPN with multiple tunnels.

Answer

Configure active-passive BGP with a single session.

Answer

Use policy-based routing to fail between tunnels.

Answer

Use static routes with a primary and backup route.

Question 11

Which two of the following are prerequisites for configuring an HA VPN tunnel to an on-premises network? (Choose two.)

Accepted Answer

A Cloud Router with BGP configured in the same region as the VPN gateway.. B is correct because an HA VPN tunnel uses dynamic routing via BGP to provide active-active or active-passive failover. A Cloud Router with BGP configured in the same region as the VPN gateway is required to exchange routes with the on-premises network, enabling automatic failover and load balancing across the two tunnels.

Answer

A VLAN attachment in the same region.

Answer

A pre-shared key that is at least 20 characters long.

Answer

An on-premises VPN device that supports static routing only.

Question 12

Which three of the following are best practices for designing a highly available Dedicated Interconnect connection to Google Cloud? (Choose three.)

Accepted Answer

Ensure that the on-premises routers are in different failure zones.. Option B is correct because deploying on-premises routers in different failure zones ensures that a single zone failure does not disrupt both BGP sessions. This aligns with Google Cloud's recommendation to use diverse failure domains for on-premises equipment to maintain high availability for Dedicated Interconnect.

Answer

Use a single Cloud Router for both interconnect attachments.

Answer

Configure both connections to use the same BGP session.

Question 13

A company needs private connectivity between its on-premises data center and Google Cloud with consistent low latency and high throughput. The on-premises location is close to a Google Cloud point of presence that supports Dedicated Interconnect. The company expects to use more than 10 Gbps of bandwidth in the near future. Which connectivity solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, offering consistent low latency and high throughput. Since the on-premises location is near a Google Cloud point of presence that supports Dedicated Interconnect and the bandwidth requirement exceeds 10 Gbps (Dedicated Interconnect supports up to 10 Gbps per circuit, with multiple circuits for higher aggregate bandwidth), this is the optimal solution.

Answer

Partner Interconnect

Answer

HA VPN with dynamic routing

Answer

Cloud VPN with static routing

Question 14

An enterprise is evaluating connectivity options to Google Cloud. They have moderate bandwidth requirements (up to 1 Gbps) and need high availability. Which two of the following are appropriate solutions? (Choose two.)

Accepted Answer

HA VPN over the internet.. HA VPN (High-Availability VPN) uses two tunnels to two separate Cloud VPN gateways, providing automatic failover and meeting the 99.99% SLA when configured with dynamic routing (BGP). This solution supports up to 3 Gbps per tunnel pair, easily covering the 1 Gbps requirement, and uses the public internet without needing physical cross-connects.

Answer

VPC peering with a third-party network.

Answer

Classic VPN with a single tunnel.

Answer

Dedicated Interconnect with 10 Gbps connections.

Question 15

A company wants to connect its on-premises data center to Google Cloud. They have a single VPN appliance on-premises and need high availability for the connection. Which architecture provides the most cost-effective high availability solution?

Accepted Answer

Deploy Cloud HA VPN with two interfaces, each with its own external IP address, and configure two tunnels to the on-premises VPN appliance.. Option D is correct because Cloud HA VPN uses two external IP addresses per tunnel and automatically provides high availability by using two VPN gateways in different regions. Option A is incorrect because using two Cloud VPN gateways in the same region does not protect against zonal failure. Option B is incorrect because a single Classic VPN tunnel is not highly available. Option C is incorrect because HA VPN with a single IP per tunnel is not supported; HA VPN requires at least two IPs.

Answer

Use a single Cloud Classic VPN tunnel with a static route.

Answer

Deploy two Cloud Classic VPN gateways in the same region, each with one tunnel to the on-premises VPN appliance.

Answer

Deploy Cloud HA VPN with one interface and one external IP address, and configure a single tunnel to the on-premises appliance.