PCNE Implementing hybrid interconnectivity Practice Test 3 — 15 Questions

Question 1

Drag and drop the steps to configure Cloud Router with BGP for on-premises connectivity into the correct order.

Question 2

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

Question 3

Drag and drop the steps to configure a global external HTTP(S) load balancer in Google Cloud into the correct order.

Question 4

Match each VPC firewall rule component to its description.

Question 5

Match each VPC networking concept to its definition.

Question 6

Match each Google Cloud Armor feature to its description.

Question 7

A company needs to connect their on-premises data center to Google Cloud with a consistent, high-availability connection that offers 99.99% availability SLA. The on-premises router supports VLAN tagging and BGP. They expect to burst up to 50 Gbps peak traffic. Which interconnect solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, supporting up to 80 Gbps per connection (via 10 or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant links and BGP sessions. The on-premises router's support for VLAN tagging and BGP aligns perfectly with Dedicated Interconnect's requirements for 802.1Q VLANs and eBGP peering, making it the only option that meets the 50 Gbps burst requirement and high-availability SLA.

Answer

Cloud VPN with dynamic routing

Answer

Partner Interconnect

Answer

HA VPN

Question 8

A network engineer has configured a Dedicated Interconnect with a VLAN attachment and Cloud Router. BGP sessions are up and routes are exchanged. However, traffic from a specific on-premises subnet is not reaching a VPC instance. The route table shows a custom static route with priority 1000 for that subnet pointing to a VPN tunnel, and a BGP learned route with priority 100 for the same subnet via Interconnect. What is the most likely reason for the traffic not using the Interconnect route?

Accepted Answer

The BGP route's next hop is not reachable due to a missing firewall rule on the on-premises side. The BGP route with priority 100 is preferred over the static route with priority 1000. However, if the BGP route's next hop is not reachable (e.g., due to a missing firewall rule on the on-premises side blocking the necessary ICMP or BGP session traffic), the route will be considered invalid and not installed in the routing table. This causes traffic to fall back to the less preferred static route via the VPN tunnel, explaining why the Interconnect path is not used.

Answer

Route propagation is disabled on the Cloud Router

Answer

VPC firewall rules are blocking traffic on the Interconnect VLAN attachment

Answer

The BGP route has a lower MED than the static route

Question 9

You are designing a hybrid network using Cloud VPN with dynamic routing (BGP) to connect multiple on-premises sites to Google Cloud. What is a best practice to avoid asymmetric routing when you have multiple VPN tunnels from different on-premises routers?

Accepted Answer

Configure all on-premises routers with the same BGP ASN and enable ECMP on the Cloud Router. Option C is correct because using the same BGP ASN on all on-premises routers and enabling ECMP on the Cloud Router allows the Cloud Router to treat multiple BGP sessions as equal-cost paths. This prevents asymmetric routing by ensuring that return traffic can be load-balanced across any available tunnel, while the same ASN avoids BGP loop-prevention mechanisms that would otherwise reject routes from routers with different ASNs.

Answer

Use static routes instead of BGP to have precise control over path selection

Answer

Use a different BGP ASN for each on-premises router to ensure uniqueness

Answer

Disable ECMP on the Cloud Router to avoid multipath issues

Question 10

An organization needs low-latency connectivity between their on-premises data center and Google Cloud, supporting up to 20 Gbps throughput. They already have a Partner Interconnect connection but need to increase capacity. Which two actions should they take? (Choose two.)

Accepted Answer

Work with the service provider to upgrade the existing interconnect to a higher capacity. Option A is correct because Partner Interconnect connections can be upgraded to higher capacity by working with the service provider, as the provider manages the underlying physical circuit. This allows increasing throughput up to 20 Gbps without replacing the existing connection, leveraging the existing Layer 2 or Layer 3 handoff.

Answer

Create additional Cloud VPN tunnels to the same region

Answer

Provision a new Dedicated Interconnect to bypass the partner

Question 11

Your company has a Dedicated Interconnect between on-premises and Google Cloud. After a maintenance window, some routes are missing from the on-premises side. On the Cloud Router, you see that the BGP session status is 'ESTABLISHED'. However, the route table on the on-premises router does not contain any of the VPC subnets. What is the most likely cause?

Accepted Answer

The Cloud Router has an empty 'Advertised IP ranges' list. The BGP session is 'ESTABLISHED', confirming that the TCP connection and BGP peering are working correctly. However, the on-premises router is not receiving any VPC subnet routes because the Cloud Router's 'Advertised IP ranges' list is empty, meaning it is not advertising any routes to the peer. This is a common misconfiguration where the Cloud Router is configured to use custom route advertisements but the list of prefixes to advertise is left blank.

Answer

The Cloud Router is not configured to advertise any custom routes

Answer

MD5 authentication is enabled but passwords differ

Answer

BGP configuration mismatch on the on-premises router

Question 12

You are troubleshooting an HA VPN connection between Google Cloud and on-premises. The tunnels appear as 'UP' but no routes are exchanged. The Cloud Router logs show 'BGP session state: IDLE'. What is the most likely cause?

Accepted Answer

BGP is not enabled on the Cloud Router. B is correct because the BGP session state IDLE indicates that BGP is not configured or enabled on the Cloud Router. Even though the IPsec tunnels are UP, no BGP routes can be exchanged if the BGP process itself is not running. In Google Cloud, you must explicitly enable BGP on the Cloud Router for each VPN tunnel; otherwise, the BGP session cannot transition from IDLE to any other state.

Answer

The BGP keepalive timer is set too high on the on-premises router

Answer

Firewall rules are blocking UDP port 179

Answer

The on-premises BGP peer is configured with a different next-hop IP

Question 13

A company uses a shared VPC with multiple service projects. They want to connect their on-premises data center to the shared VPC through a Dedicated Interconnect. Where should they configure the Cloud Router and VLAN attachment?

Accepted Answer

In the host project of the shared VPC. In a shared VPC architecture, the Cloud Router and VLAN attachment for Dedicated Interconnect must be configured in the host project because the host project owns the VPC network and manages all network resources, including interconnect attachments. Service projects consume subnets from the host project but cannot create or manage interconnect resources. This ensures that the on-premises connectivity is centrally managed and that all service projects can use the interconnect through the shared VPC's routing.

Answer

In the same region as the majority of service project instances

Answer

In a global resource policy, cross-project

Answer

In the service project that will use the connectivity

Question 14

You have set up a Dedicated Interconnect with two VLAN attachments (each 10 Gbps) and configured ECMP on the Cloud Router. You observe that traffic from on-premises to a specific VM is only using one attachment. What is the most likely cause?

Accepted Answer

The traffic consists of a single flow that is hashed to one attachment. D is correct because ECMP (Equal-Cost Multi-Path) relies on hashing of packet headers (e.g., 5-tuple: source/destination IP, protocol, source/destination port) to select a path. A single flow (e.g., a TCP connection between two specific IPs and ports) will always hash to the same attachment, so it cannot use both VLAN attachments simultaneously. This is expected behavior, not a fault.

Answer

Route propagation is disabled on one Cloud Router interface

Answer

One of the VLAN attachments has a higher route priority

Answer

BGP ASN mismatch between the two attachments

Question 15

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides a direct, private connection between your on-premises network and Google Cloud, supporting bandwidth up to 100 Gbps (via multiple 10 Gbps or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant attachments. This solution requires you to manage your own physical infrastructure in a Google colocation facility, meeting the organization's requirement for self-managed hardware.

Answer

Cloud VPN with multiple tunnels

Answer

Partner Interconnect

Answer

HA VPN