PCNE Implementing hybrid interconnectivity Practice Test 6 — 15 Questions

Question 1

A company is deploying a Global Cloud VPN with multiple tunnels from different Cloud Router instances to the same on-premises peer. The on-premises BGP speaker is configured with multiple peers. How should they configure the BGP ASN on the Cloud Routers to ensure optimal routing?

Accepted Answer

Use the same private ASN for all Cloud Routers in the same region.. Option B is correct because using the same private ASN on all Cloud Routers in the same region allows the on-premises BGP speaker to treat multiple tunnels from that region as a single BGP session, enabling load balancing and failover without creating BGP path selection issues. This approach aligns with Google Cloud's recommendation for redundant VPN tunnels, where the same ASN ensures the on-premises router sees the Cloud Routers as a single BGP peer, simplifying routing policy and avoiding unnecessary AS path prepending.

Answer

Use different private ASNs for each Cloud Router to differentiate the tunnels.

Answer

Assign a unique public ASN to each Cloud Router.

Answer

Use the same ASN across all Cloud Routers globally.

Question 2

Refer to the exhibit. A Cloud VPN tunnel is configured between an on-premises router and Google Cloud. The BGP session is not established. The on-premises router shows 'Connection refused'. What is the most likely cause?

Accepted Answer

The Cloud Router is not configured to accept BGP connections from this on-premises peer.. The 'Connection refused' error on the on-premises router indicates that the Cloud Router is actively rejecting the TCP connection attempt for the BGP session. This typically occurs when the Cloud Router does not have a BGP peer configured with the on-premises router's IP address, or the peer is in an 'inactive' state. Since the Cloud VPN tunnel itself can be established (option A is not necessarily true), the most likely cause is that the Cloud Router is not configured to accept BGP connections from this specific on-premises peer.

Answer

The Cloud VPN tunnel is not established.

Answer

The on-premises router's BGP configuration has the wrong ASN.

Answer

The BGP MD5 password is mismatched between the two peers.

Question 3

A company wants to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have ordered a 10 Gbps connection and plan to use a single VLAN attachment. How many Cloud Router interfaces are required for a single VLAN attachment with active/active BGP?

Accepted Answer

1 interface. For a single VLAN attachment using Dedicated Interconnect with active/active BGP, only one Cloud Router interface is required. The Cloud Router interface represents the VLAN attachment itself, and BGP sessions are configured as sub-interfaces under that single interface. Active/active BGP does not require multiple interfaces; it uses two BGP sessions (one for each router in the pair) but both sessions share the same VLAN attachment and Cloud Router interface.

Answer

4 interfaces (two for each BGP session)

Answer

2 interfaces (one for each VLAN)

Answer

2 interfaces (one for each BGP session)

Question 4

A network engineer is troubleshooting an HA VPN setup between Google Cloud and an on-premises data center. The two tunnels are established, and BGP sessions are up on both tunnels. However, traffic from Google Cloud to the on-premises network is only using one tunnel, even though both BGP sessions are advertising the same routes. What is the most likely cause?

Accepted Answer

The on-premises router is sending different BGP metrics (MED) for the same route on the two BGP sessions.. When both BGP sessions are up and advertising the same routes, but traffic only uses one tunnel, the most likely cause is that the on-premises router is sending different Multi-Exit Discriminator (MED) values for the same route on the two BGP sessions. MED is a metric that influences inbound traffic to an AS; a lower MED value is preferred. If one tunnel's BGP update carries a lower MED, Google Cloud's Cloud Router will select that path for all traffic, even though both tunnels are functional.

Answer

The Cloud Router is not configured for dynamic routing.

Answer

One of the IPsec tunnels is in a dead state.

Answer

The on-premises router is setting a higher local preference on one route.

Question 5

A company is using Partner Interconnect to connect their data center to Google Cloud. They notice that traffic from their on-premises network to a specific subnet in VPC is taking a suboptimal path. Which action should they take to influence the routing preference?

Accepted Answer

Configure BGP MED values on the on-premises router for the prefixes advertised to the Cloud Router.. Option D is correct because BGP MED (Multi-Exit Discriminator) is the standard mechanism for influencing inbound traffic path selection when multiple connections exist between two autonomous systems. By setting a lower MED value on the on-premises router for prefixes advertised to the Cloud Router, the on-premises network can signal Google Cloud to prefer that specific VLAN attachment for traffic destined to the subnet, thereby correcting the suboptimal path.

Answer

Use route priorities on the Cloud Router for the learned routes.

Answer

Change the VLAN attachment's mode to active-active.

Answer

Set a lower cost on the Cloud Router interface for the preferred VLAN attachment.

Question 6

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

Accepted Answer

HA VPN with a single VPN gateway and a dynamic peer IP. Option C is correct because HA VPN supports dynamic peer IP addresses through its use of IKEv2 and route-based VPN tunnels. When the branch office has a dynamic public IP, HA VPN can establish tunnels using the peer's current IP address, which is discovered during IKE negotiation. Classic VPN (option A) requires a static peer IP, and option D requires two static peer IPs, making them unsuitable for a dynamic IP scenario.

Answer

Classic VPN with a static IP on the peer

Answer

A custom SSL VPN appliance on Compute Engine

Answer

HA VPN with two VPN gateways and static peer IPs

Question 7

An organization has multiple VPCs in different regions that need to connect to a single on-premises data center via Dedicated Interconnect. They want to minimize cost and complexity. What is the recommended architecture?

Accepted Answer

Create a single interconnect connection and use multiple VLAN attachments, one per VPC.. Option D is correct because a single Dedicated Interconnect connection can support multiple VLAN attachments (each with a unique VLAN ID) to connect multiple VPCs in different regions to the same on-premises data center. This minimizes cost by using one physical connection and reduces complexity by avoiding separate interconnects or VPNs for each VPC.

Answer

Use a single VPC and then use VPC Peering to connect to the other VPCs.

Answer

Use Cloud VPN for the additional VPCs to avoid additional interconnect costs.

Answer

Create a separate interconnect connection for each VPC.

Question 8

Refer to the exhibit. A Cloud VPN tunnel is configured with the above Cloud Router configuration. The on-premises BGP peer is at 169.254.0.2 with ASN 65001. The on-premises router is receiving the route 10.0.0.0/8 from the Cloud Router, but it is not receiving any of the specific subnets (e.g., 10.1.0.0/16) that exist in the VPC. What is the most likely cause?

Accepted Answer

The Cloud Router is configured with custom advertise mode and is only advertising the manually specified ranges.. The Cloud Router is configured with custom advertise mode, which means it only advertises the manually specified CIDR ranges to the on-premises BGP peer. Since the specific subnets (e.g., 10.1.0.0/16) are not included in the custom advertised ranges, the on-premises router receives only the explicitly listed 10.0.0.0/8 route, not the more specific subnets.

Answer

The advertised_route_priority is set too low, causing the routes to be suppressed.

Answer

The BGP session is not established due to ASN mismatch.

Answer

The on-premises peer ASN is incorrect.

Question 9

A company has deployed Dedicated Interconnect with a 10 Gbps connection. They are experiencing packet loss when transferring large files. The on-premises MTU is set to 1500. What is the maximum MTU that can be set on the Cloud Router interface to avoid fragmentation?

Accepted Answer

1500 bytes. Dedicated Interconnect uses VLAN attachments that encapsulate packets with an additional 4-byte 802.1Q VLAN tag and a 4-byte outer Ethernet header. With an on-premises MTU of 1500 bytes, the maximum payload that can traverse the interconnect without fragmentation is 1500 bytes, because the interconnect path supports jumbo frames up to 1440 bytes for the payload after overhead, but the Cloud Router interface MTU must match the on-premises MTU to avoid fragmentation. Setting the Cloud Router MTU to 1500 bytes ensures that packets are not fragmented at the router, as the interconnect handles the encapsulation overhead transparently.

Answer

1460 bytes

Answer

1400 bytes

Answer

8896 bytes

Question 10

Which TWO are valid methods to allow on-premises traffic to reach Google Cloud resources that only have internal (private) IP addresses? (Choose two.)

Accepted Answer

Set up Cloud VPN or Interconnect and configure proper routing and firewall rules.. Option A is correct because Cloud VPN or Interconnect creates a secure, private connection between on-premises and Google Cloud VPCs. By configuring proper routing (e.g., custom static routes or BGP) and firewall rules, on-premises traffic can reach internal-only IP addresses without needing public IPs, as the traffic traverses the private network path.

Answer

Assign public IP addresses to the resources and use firewall rules to allow on-premises traffic.

Answer

Use Cloud NAT to allow inbound connections from on-premises.

Answer

Use the default internet gateway route for the VPC.

Question 11

Which THREE are true regarding Cloud HA VPN when used with dynamic routing (BGP)? (Choose three.)

Accepted Answer

Cloud HA VPN requires two interfaces per VPN gateway.. Option C is correct because Cloud HA VPN requires two interfaces per VPN gateway to provide high availability and redundancy. Each gateway interface connects to a separate Cloud Router, enabling active-active failover and ensuring continuous connectivity if one interface or tunnel fails.

Answer

Cloud HA VPN requires two Cloud Routers in the same region for redundancy.

Answer

Cloud HA VPN allows custom BGP timers.

Question 12

Which TWO are necessary components for setting up Dedicated Interconnect? (Choose two.)

Accepted Answer

A Cloud Router in the same region as the VLAN attachment. A Cloud Router is required in the same region as the VLAN attachment to enable dynamic routing (BGP) between your on-premises network and Google Cloud VPC. The VLAN attachment must be mapped to a VPC to define which VPC network the interconnect circuit connects to, allowing traffic to flow between your on-premises network and Google Cloud resources.

Answer

A Cloud VPN tunnel for management traffic

Answer

A QoS policy to ensure bandwidth guarantee

Answer

Two physical interconnect connections for redundancy

Question 13

Refer to the exhibit. A BGP session between a Cloud Router and an on-premises router is not establishing. The Cloud Router logs show 'BGP_OPEN_MSG_ERROR: unsupported capability'. What is the most likely issue?

Accepted Answer

The on-premises router is attempting to negotiate a BGP capability that Cloud Router does not support, such as 4-byte ASNs or IPv6 unicast.. The error message 'BGP_OPEN_MSG_ERROR: unsupported capability' indicates that during the BGP OPEN message exchange, the on-premises router advertised a BGP capability (such as 4-byte ASN support or IPv6 unicast address family) that the Cloud Router does not support. This causes the Cloud Router to reject the OPEN message and reset the session. Option D correctly identifies this mismatch in negotiated capabilities.

Answer

The on-premises router cannot reach the Cloud Router's BGP IP.

Answer

The BGP session is stuck in the Connect state due to firewall blocking TCP port 179.

Answer

The BGP ASN configured on the Cloud Router doesn't match the peer.

Question 14

Refer to the exhibit. An engineer is troubleshooting a dual-tunnel HA VPN. The BGP session on one interface is established (State/PfxRcd 1) but the other is stuck in Active state. What can cause this?

Accepted Answer

The on-premises router does not have a BGP configuration for the second peer IP address (169.254.x.x).. In a dual-tunnel HA VPN, each tunnel uses a separate BGP session with its own peer IP address (typically from the 169.254.x.x link-local range). If the on-premises router only has a BGP neighbor statement for the first peer IP, it will ignore incoming BGP packets from the second peer. The Cloud Router sees the session stuck in Active state because it is sending BGP OPEN messages but never receiving a response, as the on-premises router is not listening on that IP.

Answer

The Cloud Router is using the same BGP identifier for both sessions, causing a conflict.

Answer

The on-premises router is configured with BGP MD5 authentication that only matches the first peer.

Answer

The MTU on the second tunnel is not matching between the two ends.

Question 15

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

Accepted Answer

Enable IP forwarding on the VPN appliance VM instance.. Option C is correct because a third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.

Answer

Create a custom route in the VPC pointing to the VPN appliance's internal IP.

Answer

Enable Private Google Access on the subnet hosting the VPN appliance.

Answer

Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.