PCNE Practice Test 34 — 15 Questions

Question 1

You are designing a hybrid network using Cloud VPN with dynamic routing (BGP) to connect multiple on-premises sites to Google Cloud. What is a best practice to avoid asymmetric routing when you have multiple VPN tunnels from different on-premises routers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure all on-premises routers with the same BGP ASN and enable ECMP on the Cloud Router. Using the same BGP ASN on all on-premises routers and enabling ECMP on the Cloud Router allows the Cloud Router to treat multiple BGP sessions as equal-cost paths. This prevents asymmetric routing by ensuring that return traffic can be load-balanced across any available tunnel, while the same ASN avoids BGP loop-prevention mechanisms that would otherwise reject routes from routers with different ASNs.

Answer

Use static routes instead of BGP to have precise control over path selection

Answer

Use a different BGP ASN for each on-premises router to ensure uniqueness

Answer

Disable ECMP on the Cloud Router to avoid multipath issues

Question 2

A company is deploying a Global Cloud VPN with multiple tunnels from different Cloud Router instances to the same on-premises peer. The on-premises BGP speaker is configured with multiple peers. How should they configure the BGP ASN on the Cloud Routers to ensure optimal routing?

Accepted Answer

Use the same private ASN for all Cloud Routers in the same region.. Using the same private ASN on all Cloud Routers in the same region allows the on-premises BGP speaker to treat multiple tunnels from that region as a single BGP session, enabling load balancing and failover without creating BGP path selection issues. This approach aligns with Google Cloud's recommendation for redundant VPN tunnels, where the same ASN ensures the on-premises router sees the Cloud Routers as a single BGP peer, simplifying routing policy and avoiding unnecessary AS path prepending.

Answer

Use different private ASNs for each Cloud Router to differentiate the tunnels.

Answer

Assign a unique public ASN to each Cloud Router.

Answer

Use the same ASN across all Cloud Routers globally.

Question 3

An organization has a Dedicated Interconnect with Cloud Router configured for BGP. The on-premises network advertises a prefix that overlaps with an existing VPC subnet. How does Google Cloud handle the overlapping prefix?

Accepted Answer

It rejects the prefix and does not install a dynamic route for it.. When a Dedicated Interconnect with Cloud Router receives a BGP advertisement for a prefix that overlaps with an existing VPC subnet, Google Cloud rejects the prefix and does not install a dynamic route for it. This is because VPC subnet routes always take precedence over dynamically learned routes, and accepting an overlapping prefix would create ambiguity in forwarding decisions. The Cloud Router enforces this behavior to maintain the integrity of the VPC's internal addressing.

Answer

It accepts the prefix but static routes have higher priority.

Answer

It accepts the prefix and gives it higher priority than the VPC subnet.

Answer

It accepts the prefix and load balances traffic between the two locations.

Question 4

An engineer runs the command above to check the status of a Dedicated Interconnect VLAN attachment. The state shows DEFECTIVE. The associated interconnect connection is in ACTIVE state. What is the most likely cause?

Accepted Answer

The VLAN ID is already in use on a different attachment on the same interconnect. A Dedicated Interconnect VLAN attachment showing DEFECTIVE state while the interconnect connection itself is ACTIVE indicates a configuration conflict at the VLAN level. The most common cause is that the VLAN ID specified for this attachment is already allocated to another VLAN attachment on the same interconnect, as VLAN IDs must be unique per interconnect. This conflict prevents the attachment from establishing proper Layer 2 connectivity, resulting in a DEFECTIVE state.

Answer

The Cloud Router is not configured with a BGP session for this attachment

Answer

The maximum number of VLAN attachments for this interconnect has been exceeded

Answer

The data center power is down

Question 5

Refer to the exhibit. What is the purpose of the --enable-private-ip-google-access flag?

Accepted Answer

Allows VMs to access Google APIs without requiring an external IP.. The `--enable-private-ip-google-access` flag, when set to `true` on a subnet, allows VM instances in that subnet to reach Google APIs and services (e.g., Cloud Storage, BigQuery) using their private IP addresses, without requiring an external (public) IP. This works by routing traffic through Google's internal network to the Google API frontend, bypassing the public internet.

Answer

Enables the subnet to be used for Cloud VPN tunnels.

Answer

Allows external traffic to reach VMs using private IPs.

Answer

Enables Cloud NAT on this subnet.

Question 6

Your company has a VPC with two subnets: 10.0.1.0/24 in us-central1 and 10.0.2.0/24 in us-east1. They have a Cloud VPN tunnel to the on-premises data center using dynamic routing (BGP). The Cloud Router was created in the us-central1 region with default settings. On-premises hosts can successfully communicate with instances in the 10.0.1.0/24 subnet, but cannot reach instances in the 10.0.2.0/24 subnet. All instances have appropriate firewall rules allowing traffic from on-premises. The BGP session is established and routes from on-premises are received in Cloud Router. What is the most likely reason for the issue?

Accepted Answer

Cloud Router by default only advertises subnets in its own region.. Cloud Router with default settings only advertises subnets that are in the same region as the Cloud Router itself. Since the Cloud Router was created in us-central1, it only advertises the 10.0.1.0/24 subnet to the on-premises BGP peer. The 10.0.2.0/24 subnet in us-east1 is not advertised, so on-premises hosts have no route to it, even though the BGP session is up and firewall rules are correct.

Answer

The firewall rules in us-east1 are blocking incoming traffic from on-premises.

Answer

The BGP session is down for the us-east1 region.

Answer

The VPN tunnel is only configured to route traffic for us-central1.

Question 7

A company wants to migrate a legacy application to Google Cloud that requires low-latency communication with on-premises databases. The application is latency-sensitive and must use private IP addresses only. Which hybrid connectivity solution should they choose?

Accepted Answer

Partner Interconnect. Partner Interconnect is the correct choice because it provides a dedicated, high-bandwidth connection with low latency, supports private IP addresses, and meets the requirement for latency-sensitive communication with on-premises databases. Unlike other options, it offers a Service Level Agreement (SLA) for uptime and performance, ensuring consistent low-latency connectivity.

Answer

Cloud VPN

Answer

Carrier Peering

Answer

Direct Peering

Question 8

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

Accepted Answer

Confirm that the subnet routes for the instance IP ranges are present in the VPC. For on-premises traffic to reach Compute Engine instances over Dedicated Interconnect, the VPC must have a subnet route (either automatically created or custom static/dynamic route) that matches the instance IP ranges. Without this route, packets from the on-premises network will be dropped by the VPC router, even if the VLAN attachment is reachable.

Answer

Verify that the on-premises network has IAM permissions to access instances

Answer

Ensure that the VLAN attachment IP is in the same subnet as the instances

Answer

Check that BGP sessions are established between Cloud Router and on-premises router

Question 9

A company is designing a hybrid network with Partner Interconnect. They need to ensure high availability and meet a 99.99% SLA. Which TWO actions should they take?

Accepted Answer

Provision two Partner Interconnects from different providers or locations. To meet a 99.99% SLA, the design must eliminate single points of failure at both the physical interconnect and the logical attachment level. Provisioning two Partner Interconnects from different providers or locations ensures physical diversity, while creating two VLAN attachments (each on a different Interconnect) provides logical redundancy, allowing traffic to fail over if one attachment or interconnect fails.

Answer

Enable VPN as a backup to the Interconnect

Answer

Create a single VLAN attachment with multiple BGP sessions

Answer

Provision a single Partner Interconnect with two VLAN attachments

Question 10

Which TWO of the following are valid methods to reduce latency between users in Europe and a GCP-hosted application?

Accepted Answer

Use Cloud CDN to cache content at edge locations.. Cloud CDN uses Google's globally distributed edge caches to serve content from locations closer to users, reducing round-trip time and latency. For users in Europe, cached static or dynamic content is delivered from a nearby edge PoP, bypassing the need to fetch from the origin server in a potentially distant region.

Answer

Establish a Cloud VPN tunnel to the user's ISP.

Answer

Use Premium Tier networking instead of Standard Tier.

Answer

Use Cloud NAT for outbound traffic.

Question 11

Refer to the exhibit. A Cloud VPN tunnel is configured between an on-premises router and Google Cloud. The BGP session is not established. The on-premises router shows 'Connection refused'. What is the most likely cause?

Accepted Answer

The Cloud Router is not configured to accept BGP connections from this on-premises peer.. The 'Connection refused' error on the on-premises router indicates that the Cloud Router is actively rejecting the TCP connection attempt for the BGP session. This typically occurs when the Cloud Router does not have a BGP peer configured with the on-premises router's IP address, or the peer is in an 'inactive' state. Since the Cloud VPN tunnel itself can be established (option A is not necessarily true), the most likely cause is that the Cloud Router is not configured to accept BGP connections from this specific on-premises peer.

Answer

The Cloud VPN tunnel is not established.

Answer

The on-premises router's BGP configuration has the wrong ASN.

Answer

The BGP MD5 password is mismatched between the two peers.

Question 12

Your company has a Dedicated Interconnect between on-premises and Google Cloud. After a maintenance window, some routes are missing from the on-premises side. On the Cloud Router, you see that the BGP session status is 'ESTABLISHED'. However, the route table on the on-premises router does not contain any of the VPC subnets. What is the most likely cause?

Accepted Answer

The Cloud Router has an empty 'Advertised IP ranges' list. The BGP session is 'ESTABLISHED', confirming that the TCP connection and BGP peering are working correctly. However, the on-premises router is not receiving any VPC subnet routes because the Cloud Router's 'Advertised IP ranges' list is empty, meaning it is not advertising any routes to the peer. This is a common misconfiguration where the Cloud Router is configured to use custom route advertisements but the list of prefixes to advertise is left blank.

Answer

The Cloud Router is not configured to advertise any custom routes

Answer

MD5 authentication is enabled but passwords differ

Answer

BGP configuration mismatch on the on-premises router

Question 13

An organization has Compute Engine instances in a VPC without external IP addresses. They need to allow these instances to access Google Cloud Storage buckets but not the internet. What should they configure?

Accepted Answer

Enable Private Google Access on the subnets where the instances reside.. Private Google Access allows Compute Engine instances without external IP addresses to reach Google APIs and services, including Cloud Storage, through the VPC network's default route to the internet gateway, but only to Google's published IP ranges. This is the correct solution because it provides the required access without exposing the instances to the general internet.

Answer

Set up Cloud NAT and configure a firewall rule to allow egress to Google Cloud Storage IP ranges.

Answer

Peer the VPC with the Google Cloud Storage service VPC.

Answer

Create an egress firewall rule allowing traffic to 0.0.0.0/0 and a route to the default internet gateway.

Question 14

A company plans to connect an on-premises network to Google Cloud using HA VPN with dynamic routing (BGP). The on-premises side supports BGP and has two independent routers for redundancy. The company wants to ensure failover within seconds if one tunnel goes down. Which configuration meets this requirement?

Accepted Answer

Create two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises router, and configure a separate Cloud Router on each gateway with BGP.. Deploying two Cloud VPN gateways in different regions with separate Cloud Routers ensures true regional redundancy. If one gateway or its tunnel fails, BGP sessions on the other gateway remain active, and Google Cloud's network can immediately route traffic via the surviving path. This architecture meets the sub-second failover requirement by avoiding a single point of failure at the gateway level and leveraging BGP's fast convergence.

Answer

Create two VPN tunnels from one Cloud VPN gateway to both on-premises routers, and configure one Cloud Router with active/passive BGP.

Answer

Create two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises router, and use static routing with route metrics for failover.

Answer

Create two VPN tunnels from one Cloud VPN gateway to both on-premises routers, and configure a single Cloud Router with BGP.

Question 15

A financial institution is setting up Dedicated Interconnect with Google Cloud. They have two on-premises routers (R1 and R2) each connected to a separate Google Cloud router via VLAN attachments in two different zones (us-central1-a and us-central1-b). The on-premises routers are configured with BGP, and they advertise the corporate prefix 10.0.0.0/8. Google Cloud routers are configured with custom route advertisements. After provisioning, you notice that traffic from some on-premises subnets to GCP experiences asymmetrical routing, causing packet drops. You verify that both BGP sessions are established and that both Cloud Routers have received the 10.0.0.0/8 route. What is the most likely cause of the asymmetrical routing?

Accepted Answer

On-premises routers have mismatched BGP local preference values for routes received from Google Cloud. Asymmetrical routing in a dual-homed Dedicated Interconnect setup occurs when on-premises routers have different BGP local preference values for routes received from Google Cloud. Local preference is the first BGP attribute considered when selecting the best path outbound from the on-premises network. If R1 has a higher local preference for the GCP routes than R2, all outbound traffic from on-premises will prefer R1, while return traffic from GCP may arrive via either router (depending on GCP's routing), causing a mismatch in traffic paths and packet drops.

Answer

The on-premises routers are using the same AS number causing BGP loop prevention

Answer

VLAN attachments are configured with different MTU sizes

Answer

Cloud Router is setting different BGP metric attributes for each VLAN attachment