PCNE Practice Test 34 — 15 Questions

Question 1

Refer to the exhibit. The Cloud Router is connected to two on-premises routers via dedicated interconnect. The on-premises routers advertise the same prefix 10.1.0.0/16. Which on-premises router's route will be preferred by Google Cloud for traffic destined to 10.1.0.0/24? (Assume equal AS path length and MED from on-premises.)

Accepted Answer

The route from peer with IP 169.254.1.1. Google Cloud Router prefers the route with the higher link-local (peer) IP address when two on-premises routers advertise the same prefix via separate VLAN attachments on a Dedicated Interconnect, assuming equal AS path length and MED. Since 169.254.1.1 is higher than 169.254.0.1, the route from the peer with IP 169.254.1.1 is selected. This behavior is specific to Google Cloud's BGP best-path selection tie-breaking logic, which uses the peer IP address as a deterministic tiebreaker.

Answer

The route with lower peer IP address

Answer

Both routes will be used equally (ECMP)

Answer

The route from peer with IP 169.254.0.1

Question 2

A company is using Dedicated Interconnect to connect their on-premises network to Google Cloud. They have two VLAN attachments configured, each with a separate Cloud Router with active/active BGP. They want to ensure that traffic from their on-premises network to Google Cloud uses both attachments equally. Which configuration should they implement?

Accepted Answer

Set the same MED value on both on-premises BGP peers, and ensure the AS path length is identical.. Option A is correct because setting the same MED (Multi-Exit Discriminator) value on both on-premises BGP peers ensures that Google Cloud's Cloud Routers, which are configured with active/active BGP, will see both paths as equally preferred. When the AS path length is also identical, the BGP best-path selection algorithm on the Cloud Routers will load-balance traffic across both VLAN attachments, achieving equal utilization. This is the standard method for enabling equal-cost multipath (ECMP) over Dedicated Interconnect with multiple attachments.

Answer

Configure local preference on the Cloud Router to prefer one attachment, and rely on the other for backup.

Answer

Configure a single BGP session on one Cloud Router and use static routing for the other attachment.

Answer

Set a higher MED value on one on-premises peer to deprefer that attachment.

Question 3

Refer to the exhibit. A network engineer configured a Cloud Router to advertise the on-premises subnet 10.0.0.0/8 to the VPC. However, traffic from VPC instances to 10.0.0.0/8 is being dropped. What is the most likely issue?

Accepted Answer

The subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range.. Option C is correct because Cloud Router uses custom route advertisements, and if the on-premises subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range (e.g., the default or custom subnet ranges within the VPC), Google Cloud will not install or will drop traffic for that route due to a conflict. Overlapping routes cause the VPC to prefer its own local routes, resulting in dropped traffic to the on-premises subnet.

Answer

The advertised route has a priority that is too low.

Answer

The Cloud Router's ASN is private, causing routes to be rejected.

Answer

The on-premises router is not configured to accept the advertised route.

Question 4

An engineer runs the command above to check the status of a Dedicated Interconnect VLAN attachment. The state shows DEFECTIVE. The associated interconnect connection is in ACTIVE state. What is the most likely cause?

Accepted Answer

The VLAN ID is already in use on a different attachment on the same interconnect. A Dedicated Interconnect VLAN attachment showing DEFECTIVE state while the interconnect connection itself is ACTIVE indicates a configuration conflict at the VLAN level. The most common cause is that the VLAN ID specified for this attachment is already allocated to another VLAN attachment on the same interconnect, as VLAN IDs must be unique per interconnect. This conflict prevents the attachment from establishing proper Layer 2 connectivity, resulting in a DEFECTIVE state.

Answer

The Cloud Router is not configured with a BGP session for this attachment

Answer

The maximum number of VLAN attachments for this interconnect has been exceeded

Answer

The data center power is down

Question 5

A company has deployed Dedicated Interconnect with a 10 Gbps connection. They are experiencing packet loss when transferring large files. The on-premises MTU is set to 1500. What is the maximum MTU that can be set on the Cloud Router interface to avoid fragmentation?

Accepted Answer

1500 bytes. Dedicated Interconnect uses VLAN attachments that encapsulate packets with an additional 4-byte 802.1Q VLAN tag and a 4-byte outer Ethernet header. With an on-premises MTU of 1500 bytes, the maximum payload that can traverse the interconnect without fragmentation is 1500 bytes, because the interconnect path supports jumbo frames up to 1440 bytes for the payload after overhead, but the Cloud Router interface MTU must match the on-premises MTU to avoid fragmentation. Setting the Cloud Router MTU to 1500 bytes ensures that packets are not fragmented at the router, as the interconnect handles the encapsulation overhead transparently.

Answer

1460 bytes

Answer

1400 bytes

Answer

8896 bytes

Question 6

An organization uses Partner Interconnect to connect their on-premises network to Google Cloud. They are experiencing intermittent connectivity issues and suspect the partner service provider is causing the problem. Which Google Cloud tool or feature can help verify the connection status and performance from the Google Cloud side?

Accepted Answer

Cloud Interconnect monitoring. Cloud Interconnect monitoring provides detailed metrics and status information for Partner Interconnect connections, including VLAN attachment health, throughput, and packet loss. This tool allows you to verify connectivity and performance from the Google Cloud side, helping isolate issues that may originate from the partner service provider.

Answer

Cloud Router logs

Answer

Network Service Tiers

Answer

VPC flow logs

Question 7

A customer reports that after setting up HA VPN, some on-premises subnets are not reachable from Google Cloud. The Cloud Router shows the missing routes. What is the most likely cause?

Accepted Answer

BGP route filters are blocking the advertisement of those subnets.. Option C is correct because the Cloud Router shows the missing routes, indicating that the VPN tunnel and BGP session are up, but the routes are not being installed. BGP route filters on the Cloud Router or on-premises router can explicitly block the advertisement of specific subnets, preventing them from being learned and installed in the routing table even though the BGP session is established.

Answer

The VPN tunnel is down.

Answer

The on-premises router is not configured to advertise those subnets.

Answer

The shared secret is incorrect.

Question 8

A company is deploying a Global Cloud VPN with multiple tunnels from different Cloud Router instances to the same on-premises peer. The on-premises BGP speaker is configured with multiple peers. How should they configure the BGP ASN on the Cloud Routers to ensure optimal routing?

Accepted Answer

Use the same private ASN for all Cloud Routers in the same region.. Option B is correct because using the same private ASN on all Cloud Routers in the same region allows the on-premises BGP speaker to treat multiple tunnels from that region as a single BGP session, enabling load balancing and failover without creating BGP path selection issues. This approach aligns with Google Cloud's recommendation for redundant VPN tunnels, where the same ASN ensures the on-premises router sees the Cloud Routers as a single BGP peer, simplifying routing policy and avoiding unnecessary AS path prepending.

Answer

Use different private ASNs for each Cloud Router to differentiate the tunnels.

Answer

Assign a unique public ASN to each Cloud Router.

Answer

Use the same ASN across all Cloud Routers globally.

Question 9

An organization is migrating a legacy application to GCP. The application requires a static internal IP address for a Compute Engine VM that must persist even if the VM is stopped or deleted. Which IP address type should they assign?

Accepted Answer

Reserve a static internal IP address in the same region and subnetwork.. A static internal IP address is reserved within a specific region and subnetwork, ensuring the IP persists even after the VM is stopped or deleted. This meets the requirement for a fixed internal address that remains available for reassignment to the same or a different VM in the same subnet. Ephemeral IPs are released on VM stop/delete, and external IPs are not relevant for internal-only communication.

Answer

Configure an alias IP range on the VM's network interface.

Answer

Assign an ephemeral external IP and configure a firewall rule.

Answer

Use a regional internal IP address with auto-delete set to false.

Question 10

An organization uses HA VPN with dynamic routing and active-active BGP sessions. One tunnel fails, but traffic continues to flow through the other tunnel. However, they notice increased latency. What is the most likely explanation?

Accepted Answer

BGP multipath is enabled, causing all traffic to be sent through the remaining tunnel.. When BGP multipath is enabled on an HA VPN with active-active BGP sessions, the router can load-balance traffic across multiple tunnels. If one tunnel fails, all traffic is redirected through the remaining tunnel, which can cause increased latency due to congestion or suboptimal path selection. The correct answer is A because this behavior directly explains the latency increase after a tunnel failure.

Answer

The remaining tunnel is using a different encryption algorithm.

Answer

The BGP timers are misconfigured.

Answer

The failed tunnel's routes are still in the routing table.

Question 11

After configuring Cloud VPN with dynamic routing (BGP), you notice that on-premises routes are not appearing in Google Cloud. BGP sessions are established but no prefixes are exchanged. Cloud Router logs show: 'No route advertisement received'. On-premises BGP configuration shows 'network 10.0.0.0/8' and 'neighbor 10.1.1.1 remote-as 65000'. What is the most likely cause?

Accepted Answer

The 'network 10.0.0.0/8' command does not have a corresponding exact route in the on-premises routing table; also missing 'neighbor 10.1.1.1 activate' under BGP.. Option A is correct because the on-premises BGP configuration uses the 'network 10.0.0.0/8' command, which requires an exact match in the local routing table to be advertised. Without a route for 10.0.0.0/8 (e.g., a connected or static route), BGP will not advertise it. Additionally, the 'neighbor 10.1.1.1 activate' command is missing under BGP, which is required to enable the exchange of prefixes with that neighbor. These two issues together prevent route advertisement to Google Cloud.

Answer

The on-premises router's BGP peer IP is not in the same subnet as the Cloud Router's interface.

Answer

The Cloud Router's BGP peer IP is not reachable from the on-premises router.

Answer

The BGP MD5 password is configured incorrectly on the on-premises router.

Question 12

An organization has a hybrid network with multiple VPN tunnels connecting their on-premises network to Google Cloud. They use Cloud Router with BGP to propagate routes. They recently added a new subnet 192.168.100.0/24 in Google Cloud. On-premises devices can reach resources in the new subnet, but Google Cloud resources cannot initiate traffic to certain on-premises hosts in the 10.0.0.0/8 subnet. BGP sessions are all established. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking traffic initiated from the 192.168.100.0/24 subnet because it is not in the permitted list.. The issue is that on-premises hosts in 10.0.0.0/8 can be reached from the new Google Cloud subnet (192.168.100.0/24) because BGP routes are propagated, but return traffic initiated from on-premises hosts is blocked by the on-premises firewall. Since BGP sessions are established and routes are exchanged, the problem is not routing but stateful firewall filtering: the on-premises firewall likely has a rule that permits traffic from known subnets but does not include 192.168.100.0/24, so return packets for connections initiated from Google Cloud are dropped.

Answer

The VPC firewall rules are blocking outbound traffic from the new subnet.

Answer

There is a route conflict between the 192.168.100.0/24 route and an existing route in the on-premises routing table.

Answer

The on-premises BGP router is not advertising the 10.0.0.0/8 network because a mask mismatch.

Question 13

Which THREE of the following are requirements for setting up a Dedicated Interconnect connection to Google Cloud? (Choose three.)

Accepted Answer

A Layer 2 circuit between the on-premises router and Google's edge router.. Option A is correct because a Dedicated Interconnect requires a Layer 2 circuit (e.g., Ethernet VLAN) that directly connects your on-premises router to a Google edge router at a colocation facility. This Layer 2 link provides the physical or virtual circuit over which BGP sessions are established to exchange routes between your network and Google Cloud.

Answer

A public IP address on the on-premises router for BGP peering.

Answer

BGP sessions must be configured directly on the VLAN attachment.

Question 14

A financial institution is setting up Dedicated Interconnect with Google Cloud. They have two on-premises routers (R1 and R2) each connected to a separate Google Cloud router via VLAN attachments in two different zones (us-central1-a and us-central1-b). The on-premises routers are configured with BGP, and they advertise the corporate prefix 10.0.0.0/8. Google Cloud routers are configured with custom route advertisements. After provisioning, you notice that traffic from some on-premises subnets to GCP experiences asymmetrical routing, causing packet drops. You verify that both BGP sessions are established and that both Cloud Routers have received the 10.0.0.0/8 route. What is the most likely cause of the asymmetrical routing?

Accepted Answer

On-premises routers have mismatched BGP local preference values for routes received from Google Cloud. Asymmetrical routing in a dual-homed Dedicated Interconnect setup occurs when on-premises routers have different BGP local preference values for routes received from Google Cloud. Local preference is the first BGP attribute considered when selecting the best path outbound from the on-premises network. If R1 has a higher local preference for the GCP routes than R2, all outbound traffic from on-premises will prefer R1, while return traffic from GCP may arrive via either router (depending on GCP's routing), causing a mismatch in traffic paths and packet drops.

Answer

The on-premises routers are using the same AS number causing BGP loop prevention

Answer

VLAN attachments are configured with different MTU sizes

Answer

Cloud Router is setting different BGP metric attributes for each VLAN attachment

Question 15

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They have two VLAN attachments (vlan-100 and vlan-200) connected to two separate Cloud Routers in the same region. Each Cloud Router has a BGP session with the on-premises router. The on-premises router advertises the same prefixes (10.0.0.0/8) over both sessions. In Google Cloud, they have workloads in two different VPCs: VPC-A and VPC-B. They want traffic to VPC-A to use vlan-100, and traffic to VPC-B to use vlan-200. Cloud Router 1 is attached to VPC-A, Cloud Router 2 is attached to VPC-B. Currently, traffic from on-premises to VPC-A sometimes goes through vlan-200, causing asymmetric routing. What configuration change should they make to ensure traffic is symmetric?

Accepted Answer

Use BGP community tags on the on-premises router to label routes for VPC-A and VPC-B, and configure route priority on Cloud Router to match these communities.. Option D is correct because BGP community tags allow the on-premises router to tag routes for VPC-A and VPC-B differently. Cloud Router can then use these community tags to influence route priority (e.g., via local preference or MED matching), ensuring that traffic to VPC-A is always routed through vlan-100 and traffic to VPC-B through vlan-200, solving the asymmetric routing issue without relying on static routes or MED manipulation that would affect all traffic.

Answer

Set a higher MED on the on-premises router for routes advertised to vlan-200, making vlan-100 preferred for all traffic.

Answer

Configure static routes on the on-premises router to force traffic to VPC-A via vlan-100 and to VPC-B via vlan-200.

Answer

Create two separate VPCs and assign each VLAN attachment to a different VPC.

PCNE Practice Test 34 — 15 Questions

Exhibit

PCNE Practice Test 34 — 15 Questions

Exhibit