PCNE Practice Test 33 — 15 Questions

Question 1

A company is using Cloud VPN to connect to Google Cloud. They notice that traffic from their on-premises network to Google Cloud is not being routed correctly after a recent change. On the on-premises router, they verify that the BGP session is established and routes are received. Which step should they take next to troubleshoot?

Accepted Answer

Verify that the routes learned via BGP are being propagated to the VPC network by examining Cloud Router details. Since the BGP session is established and routes are received on the on-premises router, the issue is likely that those routes are not being propagated into the VPC network. Cloud Router acts as the BGP speaker for the VPC; even if the VPN tunnel is up and BGP peering is successful, the learned routes must be advertised into the VPC’s routing tables. Verifying Cloud Router details (e.g., using `gcloud compute routers get-status` or checking the Cloud Console) confirms whether the routes are being accepted and propagated, which directly addresses the routing failure.

Answer

Check the on-premises firewall logs

Answer

Disable and re-enable the VPN tunnel

Answer

Check the tunnel status in Cloud Console

Question 2

Which THREE of the following could cause a Dedicated Interconnect BGP session to go to the 'IDLE' state?

Accepted Answer

Firewall rules blocking UDP port 179. Option A is correct because BGP uses TCP port 179 for establishing and maintaining sessions. If a firewall blocks UDP port 179, it would not affect BGP directly, as BGP relies on TCP, not UDP. However, the question states 'UDP port 179' which is a common misdirection; in reality, blocking TCP port 179 would cause the BGP session to go to IDLE state. The IDLE state indicates that the BGP process is not attempting to establish a connection, often due to a failure in the underlying TCP connection.

Answer

BGP keepalive timer mismatch

Answer

Multi-Exit Discriminator (MED) mismatch

Question 3

A network engineer is configuring Cloud Router for Dedicated Interconnect. The on-premises router is advertising a route to 10.1.0.0/16. The engineer wants to ensure that Google Cloud always prefers this route over other routes learned from different on-premises routers. Which BGP attribute should be set on the on-premises router?

Accepted Answer

MED. MED (Multi-Exit Discriminator) is the correct BGP attribute to influence inbound traffic from Google Cloud to prefer a specific on-premises router when multiple paths exist. By setting a lower MED value on the on-premises router, the Cloud Router will select that route over others with higher MED values, ensuring Google Cloud always prefers this path for traffic destined to 10.1.0.0/16.

Answer

NEXT_HOP

Answer

AS_PATH

Answer

LOCAL_PREF

Question 4

A company is using Partner Interconnect to connect their data center to Google Cloud. They notice that traffic from their on-premises network to a specific subnet in VPC is taking a suboptimal path. Which action should they take to influence the routing preference?

Accepted Answer

Configure BGP MED values on the on-premises router for the prefixes advertised to the Cloud Router.. Option D is correct because BGP MED (Multi-Exit Discriminator) is the standard mechanism for influencing inbound traffic path selection when multiple connections exist between two autonomous systems. By setting a lower MED value on the on-premises router for prefixes advertised to the Cloud Router, the on-premises network can signal Google Cloud to prefer that specific VLAN attachment for traffic destined to the subnet, thereby correcting the suboptimal path.

Answer

Use route priorities on the Cloud Router for the learned routes.

Answer

Change the VLAN attachment's mode to active-active.

Answer

Set a lower cost on the Cloud Router interface for the preferred VLAN attachment.

Question 5

A company has a Dedicated Interconnect with one 10 Gbps connection. They need high availability for critical workloads. Which design is the best practice according to Google Cloud recommendations?

Accepted Answer

Provision a second Dedicated Interconnect connection to a different PoP.. Google Cloud best practice for high availability with Dedicated Interconnect requires at least two physical connections, each to a different edge point of presence (PoP), to eliminate single points of failure at the network edge. A single 10 Gbps connection, even with a backup VPN, does not provide the same SLA or bandwidth guarantees for critical workloads. Option A ensures that if one PoP or provider fails, the other connection can maintain connectivity.

Answer

Add a second connection to the same PoP using the same provider.

Answer

Rely on the single connection and monitor for failures.

Answer

Use Cloud VPN as a backup to the Dedicated Interconnect.

Question 6

A Cloud VPN with dynamic routing (BGP) is established between an on-premises network and Google Cloud. The on-premises BGP router is advertising a default route (0.0.0.0/0). The Cloud Router in Google Cloud is receiving this route, but network traffic from Google Cloud VMs to the internet is not being routed through the VPN. Which THREE troubleshooting steps should you take? (Choose three.)

Accepted Answer

Verify that the VPC's dynamic routing mode is set to 'global' if using regional routing.. Option A is correct because the VPC's dynamic routing mode determines the scope of route propagation. If the VPC uses regional dynamic routing, Cloud Router only propagates routes within the region where the VPN tunnel is attached. A global dynamic routing mode is required for the BGP-learned default route to be available across all regions, ensuring VMs in any region can use the VPN for internet egress.

Answer

Check VPC firewall rules to ensure they allow egress traffic from VMs.

Answer

Ensure that the on-premises router is sending the default route with a higher local preference.

Question 7

A network engineer is configuring a Cloud VPN tunnel with route-based VPN and BGP. The tunnel is established, but the Cloud Router does not learn any routes from the on-premises peer. What is the most likely cause?

Accepted Answer

All of the above are possible causes.. Option C is correct because both A and B are independently plausible causes for the Cloud Router not learning routes from the on-premises peer. Firewall rules blocking UDP port 179 would prevent BGP session establishment entirely, while failing to configure the BGP session on the VPN tunnel interface means the BGP peering cannot form even if the tunnel is up. Since the question asks for the 'most likely cause' and both are valid, 'All of the above are possible causes' is the best answer.

Answer

Firewall rules on the on-prem router block UDP port 179.

Answer

The BGP session is not configured on the VPN tunnel.

Answer

The Cloud Router does not have an ASN configured.

Question 8

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They require high availability for the connection. Which TWO of the following are recommended by Google for achieving high availability? (Choose two.)

Accepted Answer

Order two Dedicated Interconnect connections in the same metro. Option D is correct because Google recommends ordering two Dedicated Interconnect connections in the same metro to provide link-level redundancy. Option E is correct because connecting to two different Interconnect locations (POPs) provides site-level redundancy, protecting against a single POP failure. Together, these two approaches ensure high availability for the hybrid connection.

Answer

Use a single Dedicated Interconnect with double the bandwidth

Answer

Connect to two different edge availability domains in the same POP

Answer

Order connections from two different service providers

Question 9

A company wants to connect an on-premises network to Google Cloud using Cloud VPN. The on-premises network has a single subnet and no dynamic routing capabilities. The company needs a simple, low-cost solution. Which VPN configuration should they choose?

Accepted Answer

Classic VPN with route-based configuration. Classic VPN with route-based configuration is the correct choice because the on-premises network lacks dynamic routing capabilities and requires a simple, low-cost solution. Route-based VPNs use static routes and do not require BGP, making them ideal for environments without dynamic routing support. Classic VPN is the legacy, lower-cost option compared to HA VPN, and route-based configuration allows traffic to be forwarded based on routing table entries rather than policy-based selectors.

Answer

HA VPN with dynamic routing (BGP)

Answer

HA VPN with static routing

Answer

Classic VPN with policy-based configuration

Question 10

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

Accepted Answer

HA VPN with a single VPN gateway and a dynamic peer IP. Option C is correct because HA VPN supports dynamic peer IP addresses through its use of IKEv2 and route-based VPN tunnels. When the branch office has a dynamic public IP, HA VPN can establish tunnels using the peer's current IP address, which is discovered during IKE negotiation. Classic VPN (option A) requires a static peer IP, and option D requires two static peer IPs, making them unsuitable for a dynamic IP scenario.

Answer

Classic VPN with a static IP on the peer

Answer

A custom SSL VPN appliance on Compute Engine

Answer

HA VPN with two VPN gateways and static peer IPs

Question 11

A company with multiple VPCs in a Shared VPC environment wants to connect their on-premises network to all VPCs with high availability and minimal cost. They already have a Dedicated Interconnect. What is the most efficient solution?

Accepted Answer

Use the existing Dedicated Interconnect to create multiple VLAN attachments, one per VPC.. Option C is correct because a Dedicated Interconnect can support multiple VLAN attachments (each with a separate VLAN ID and BGP session) to connect to different VPCs in a Shared VPC environment. This approach leverages the existing physical connection, provides high availability through redundant attachments, and minimizes cost by avoiding additional circuits or VPN tunnels.

Answer

Set up Cloud VPN with dynamic routing to each VPC.

Answer

Create an HA VPN gateway for each VPC and peer with on-prem.

Answer

Provision a new Partner Interconnect for each VPC.

Question 12

A company has two Dedicated Interconnect connections to two separate Google Cloud regions for redundancy. They use Cloud Router with BGP to exchange routes. They want to ensure that traffic from on-premises to a specific VPC in us-central1 uses only the interconnect to us-central1, and the other interconnect is used only as a backup. How can they achieve this?

Accepted Answer

Configure MED values on the on-premises router to prefer the us-central1 interconnect.. Option A is correct because Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to a specific entry point. By setting a lower MED value on the on-premises router for the routes advertised via the us-central1 interconnect, the on-premises network will prefer that path for traffic destined to the VPC in us-central1. The other interconnect will only be used if the preferred path fails, providing the desired active/backup behavior.

Answer

Configure BGP communities on Google Cloud to prefer the us-central1 interconnect.

Answer

Configure AS path prepending on the on-premises router to make the us-central1 path longer.

Answer

Use Cloud Router's custom route advertisements to influence path selection.

Question 13

A company currently uses Cloud VPN with dynamic routing to connect to Google Cloud. They want to migrate to Dedicated Interconnect without downtime. Which THREE steps should they take to achieve a seamless migration? (Choose three.)

Accepted Answer

Order and provision the Dedicated Interconnect. Option A is correct because ordering and provisioning the Dedicated Interconnect is the foundational step to establish the physical connection between the on-premises network and Google Cloud. Without this, no migration can occur. This involves working with a Google Cloud partner to ensure the cross-connect is completed and the VLAN attachments are created.

Answer

Decrease the BGP route priority (MED) on the VPN advertisements to make VPN less preferred

Answer

Update on-premises firewall rules to allow traffic over the new Interconnect

Question 14

An engineer is configuring Dedicated Interconnect between an on-premises data center and Google Cloud. Cloud Router is set up with BGP sessions. The BGP session remains in Idle state. Which of the following is the most likely cause?

Accepted Answer

The Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface.. The BGP session remains in Idle state because the Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface. For BGP peering over Dedicated Interconnect, the two routers must be directly connected at Layer 3, meaning their BGP peer IP addresses must belong to the same /30 or /31 subnet. If they are in different subnets, the TCP connection for BGP cannot be established, keeping the session in Idle state.

Answer

The on-premises router is not advertising the Google Cloud VPC subnet routes.

Answer

The interconnect is not configured with redundant links.

Answer

The VLAN attachment is not in the same region as the Cloud Router.

Question 15

An organization has multiple VPCs in different regions that need to connect to a single on-premises data center via Dedicated Interconnect. They want to minimize cost and complexity. What is the recommended architecture?

Accepted Answer

Create a single interconnect connection and use multiple VLAN attachments, one per VPC.. Option D is correct because a single Dedicated Interconnect connection can support multiple VLAN attachments (each with a unique VLAN ID) to connect multiple VPCs in different regions to the same on-premises data center. This minimizes cost by using one physical connection and reduces complexity by avoiding separate interconnects or VPNs for each VPC.

Answer

Use a single VPC and then use VPC Peering to connect to the other VPCs.

Answer

Use Cloud VPN for the additional VPCs to avoid additional interconnect costs.

Answer

Create a separate interconnect connection for each VPC.