PCNE Implementing hybrid interconnectivity Practice Test 5 — 15 Questions

Question 1

A company wants to connect an on-premises network to Google Cloud using Cloud VPN. The on-premises network has a single subnet and no dynamic routing capabilities. The company needs a simple, low-cost solution. Which VPN configuration should they choose?

Accepted Answer

Classic VPN with route-based configuration. Classic VPN with route-based configuration is the correct choice because the on-premises network lacks dynamic routing capabilities and requires a simple, low-cost solution. Route-based VPNs use static routes and do not require BGP, making them ideal for environments without dynamic routing support. Classic VPN is the legacy, lower-cost option compared to HA VPN, and route-based configuration allows traffic to be forwarded based on routing table entries rather than policy-based selectors.

Answer

HA VPN with dynamic routing (BGP)

Answer

HA VPN with static routing

Answer

Classic VPN with policy-based configuration

Question 2

An engineer is configuring Dedicated Interconnect between an on-premises data center and Google Cloud. Cloud Router is set up with BGP sessions. The BGP session remains in Idle state. Which of the following is the most likely cause?

Accepted Answer

The Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface.. The BGP session remains in Idle state because the Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface. For BGP peering over Dedicated Interconnect, the two routers must be directly connected at Layer 3, meaning their BGP peer IP addresses must belong to the same /30 or /31 subnet. If they are in different subnets, the TCP connection for BGP cannot be established, keeping the session in Idle state.

Answer

The on-premises router is not advertising the Google Cloud VPC subnet routes.

Answer

The interconnect is not configured with redundant links.

Answer

The VLAN attachment is not in the same region as the Cloud Router.

Question 3

A company has two Dedicated Interconnect connections to two separate Google Cloud regions for redundancy. They use Cloud Router with BGP to exchange routes. They want to ensure that traffic from on-premises to a specific VPC in us-central1 uses only the interconnect to us-central1, and the other interconnect is used only as a backup. How can they achieve this?

Accepted Answer

Configure MED values on the on-premises router to prefer the us-central1 interconnect.. Option A is correct because Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to a specific entry point. By setting a lower MED value on the on-premises router for the routes advertised via the us-central1 interconnect, the on-premises network will prefer that path for traffic destined to the VPC in us-central1. The other interconnect will only be used if the preferred path fails, providing the desired active/backup behavior.

Answer

Configure BGP communities on Google Cloud to prefer the us-central1 interconnect.

Answer

Configure AS path prepending on the on-premises router to make the us-central1 path longer.

Answer

Use Cloud Router's custom route advertisements to influence path selection.

Question 4

An organization wants to connect their on-premises network to Google Cloud using Partner Interconnect. Which of the following is a requirement that must be met before the partner can provision the connection?

Accepted Answer

The organization must have a VLAN attachment created and share the pairing key.. Partner Interconnect requires the customer to create a VLAN attachment in their Google Cloud project and share the generated pairing key with the service provider. The partner uses this key to provision the connection on their side, ensuring the correct mapping to the customer's VPC. Without the VLAN attachment and pairing key, the partner cannot establish the Layer 2 circuit.

Answer

The organization must purchase a cross-connect at a colocation facility.

Answer

The organization must have a Dedicated Interconnect connection already set up.

Answer

The organization must have a Cloud Router configured with BGP sessions.

Question 5

An enterprise uses HA VPN to connect their on-premises network to Google Cloud. The on-premises side has a single VPN device that supports BGP. They want to maximize availability. What is the recommended Google Cloud configuration?

Accepted Answer

Deploy a single Cloud VPN gateway with two interfaces, each with its own external IP, and configure two BGP sessions to the single on-premises device.. Option C is correct because it provides high availability by using a single Cloud VPN gateway with two interfaces, each with its own external IP, and two BGP sessions to the on-premises device. This configuration allows active/active failover: if one interface or BGP session fails, traffic automatically switches to the other, maximizing availability without requiring multiple regions.

Answer

Deploy two Cloud VPN gateways in different regions to provide regional failover.

Answer

Deploy a single Cloud VPN gateway with one interface and one BGP session.

Answer

Deploy a single Cloud VPN gateway with two interfaces, but only use one BGP session for simplicity.

Question 6

Company A and Company B both have networks in Google Cloud. They want to connect their VPCs using VPC peering, but they have overlapping IP addresses. How can they resolve this?

Accepted Answer

Use Cloud VPN to establish connectivity between the VPCs, as VPC peering cannot handle overlapping IPs.. VPC peering does not support overlapping IP ranges. The only option from the list that can handle overlapping IPs is Cloud VPN with network address translation or filtering.

Answer

Configure Private Service Connect to connect the VPCs.

Answer

Configure VPC peering with custom route exchange to exclude the overlapping subnets.

Answer

Use Dedicated Interconnect to connect the VPCs through a central router.

Question 7

A network engineer is configuring Cloud Router for Dedicated Interconnect. The on-premises router is advertising a route to 10.1.0.0/16. The engineer wants to ensure that Google Cloud always prefers this route over other routes learned from different on-premises routers. Which BGP attribute should be set on the on-premises router?

Accepted Answer

MED. MED (Multi-Exit Discriminator) is the correct BGP attribute to influence inbound traffic from Google Cloud to prefer a specific on-premises router when multiple paths exist. By setting a lower MED value on the on-premises router, the Cloud Router will select that route over others with higher MED values, ensuring Google Cloud always prefers this path for traffic destined to 10.1.0.0/16.

Answer

NEXT_HOP

Answer

AS_PATH

Answer

LOCAL_PREF

Question 8

An engineer has configured an HA VPN tunnel between an on-premises network and Google Cloud. The tunnel status shows as established, but traffic is not flowing. The engineer checks the Cloud Router BGP session and sees it is in the Active state. What is the most likely cause?

Accepted Answer

The Cloud Router is not configured with the correct BGP IP address for the on-premises side.. The BGP session being in the Active state indicates that the Cloud Router has sent an Open message but has not received a valid response from the on-premises peer. This most commonly occurs when the BGP peer IP address configured on the Cloud Router does not match the IP address the on-premises router is using for BGP peering, preventing the TCP connection on port 179 from completing. Since the tunnel is established (IPsec is up), the issue is at the BGP layer, not the tunnel layer.

Answer

The tunnel's shared secret (pre-shared key) is mismatched.

Answer

The Cloud Router is not advertising the VPC subnet routes.

Answer

The on-premises router is not allowing BGP traffic on UDP port 179.

Question 9

A company has two HA VPN tunnels from on-premises to Google Cloud using two separate Cloud Routers for redundancy. The on-premises network uses BGP and advertises a default route to Google Cloud. The company wants to ensure that traffic from Google Cloud to on-premises prefers the primary Cloud Router over the secondary. Which configuration should be applied?

Accepted Answer

Set a higher LOCAL_PREF on the primary Cloud Router for the default route.. Option C is correct because LOCAL_PREF is a well-known mandatory BGP attribute that is used to influence outbound traffic from an AS. By setting a higher LOCAL_PREF on the primary Cloud Router for the default route, Google Cloud will prefer that path for traffic destined to on-premises, as LOCAL_PREF is evaluated before other attributes like AS_PATH and MED.

Answer

Set the primary Cloud Router's BGP IP as the next-hop for all routes on the secondary.

Answer

Set a lower MED on the primary Cloud Router's BGP session for the default route advertisement.

Answer

Set a shorter AS_PATH on the primary Cloud Router's BGP session.

Question 10

Which two of the following are prerequisites for configuring an HA VPN tunnel to an on-premises network? (Choose two.)

Accepted Answer

A Cloud Router with BGP configured in the same region as the VPN gateway.. B is correct because an HA VPN tunnel uses dynamic routing via BGP to provide active-active or active-passive failover. A Cloud Router with BGP configured in the same region as the VPN gateway is required to exchange routes with the on-premises network, enabling automatic failover and load balancing across the two tunnels.

Answer

A VLAN attachment in the same region.

Answer

A pre-shared key that is at least 20 characters long.

Answer

An on-premises VPN device that supports static routing only.

Question 11

Which three of the following are best practices for designing a highly available Dedicated Interconnect connection to Google Cloud? (Choose three.)

Accepted Answer

Ensure that the on-premises routers are in different failure zones.. Option B is correct because deploying on-premises routers in different failure zones ensures that a single zone failure does not disrupt both BGP sessions. This aligns with Google Cloud's recommendation to use diverse failure domains for on-premises equipment to maintain high availability for Dedicated Interconnect.

Answer

Use a single Cloud Router for both interconnect attachments.

Answer

Configure both connections to use the same BGP session.

Question 12

An enterprise is evaluating connectivity options to Google Cloud. They have moderate bandwidth requirements (up to 1 Gbps) and need high availability. Which two of the following are appropriate solutions? (Choose two.)

Accepted Answer

HA VPN over the internet.. HA VPN (High-Availability VPN) uses two tunnels to two separate Cloud VPN gateways, providing automatic failover and meeting the 99.99% SLA when configured with dynamic routing (BGP). This solution supports up to 3 Gbps per tunnel pair, easily covering the 1 Gbps requirement, and uses the public internet without needing physical cross-connects.

Answer

VPC peering with a third-party network.

Answer

Classic VPN with a single tunnel.

Answer

Dedicated Interconnect with 10 Gbps connections.

Question 13

Refer to the exhibit. The Cloud Router is connected to two on-premises routers via dedicated interconnect. The on-premises routers advertise the same prefix 10.1.0.0/16. Which on-premises router's route will be preferred by Google Cloud for traffic destined to 10.1.0.0/24? (Assume equal AS path length and MED from on-premises.)

Accepted Answer

The route from peer with IP 169.254.1.1. Google Cloud Router prefers the route with the higher link-local (peer) IP address when two on-premises routers advertise the same prefix via separate VLAN attachments on a Dedicated Interconnect, assuming equal AS path length and MED. Since 169.254.1.1 is higher than 169.254.0.1, the route from the peer with IP 169.254.1.1 is selected. This behavior is specific to Google Cloud's BGP best-path selection tie-breaking logic, which uses the peer IP address as a deterministic tiebreaker.

Answer

The route with lower peer IP address

Answer

Both routes will be used equally (ECMP)

Answer

The route from peer with IP 169.254.0.1

Question 14

Refer to the exhibit. An engineer has configured HA VPN with two tunnels (tunnel-a and tunnel-b) to an on-premises network. The BGP session for peer-b is in IDLE state. What is the most likely cause?

Accepted Answer

The on-premises router's BGP configuration for peer-b has a wrong IP address.. The BGP session for peer-b is in IDLE state, which typically indicates a TCP connection failure. Since tunnel-a is working, the Cloud Router and VPN gateway are correctly configured, and the issue is specific to peer-b. The most likely cause is that the on-premises router's BGP configuration for peer-b has the wrong IP address (e.g., the wrong BGP peer IP or the wrong Cloud Router interface IP), preventing the TCP handshake from completing.

Answer

The Cloud Router is not in the same region as the VPN gateway.

Answer

The on-premises router is not advertising any routes.

Answer

The pre-shared key for tunnel-b is incorrect.

Question 15

Refer to the exhibit. A network engineer configured a Cloud Router to advertise the on-premises subnet 10.0.0.0/8 to the VPC. However, traffic from VPC instances to 10.0.0.0/8 is being dropped. What is the most likely issue?

Accepted Answer

The subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range.. Option C is correct because Cloud Router uses custom route advertisements, and if the on-premises subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range (e.g., the default or custom subnet ranges within the VPC), Google Cloud will not install or will drop traffic for that route due to a conflict. Overlapping routes cause the VPC to prefer its own local routes, resulting in dropped traffic to the on-premises subnet.

Answer

The advertised route has a priority that is too low.

Answer

The Cloud Router's ASN is private, causing routes to be rejected.

Answer

The on-premises router is not configured to accept the advertised route.