PCNE Implementing hybrid interconnectivity Practice Test 8 — 15 Questions

Question 1

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

Accepted Answer

Configure active-active BGP with multiple sessions using different ASNs.. Option B is correct because active-active BGP with multiple sessions using different ASNs allows each tunnel to be treated as an independent path. If one tunnel fails, BGP withdraws the routes learned over that session, and traffic automatically shifts to the remaining tunnels without manual intervention. This configuration provides true automatic failover and load balancing, which is a best practice for HA VPN with multiple tunnels.

Answer

Configure active-passive BGP with a single session.

Answer

Use policy-based routing to fail between tunnels.

Answer

Use static routes with a primary and backup route.

Question 2

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

Accepted Answer

The BGP routes for that subnet are not advertised.. The Dedicated Interconnect is up and the organization can ping instances in one subnet, which confirms that Layer 2 and basic Layer 3 connectivity (via the VLAN attachment) are working. However, the inability to reach a service on a different subnet within the same VPC indicates that the on-premises router does not have a route to that specific subnet. This is most likely because the BGP session is not advertising the prefix for that subnet, or the on-premises router is not receiving the route via BGP. Without the route, traffic from on-premises to that subnet will be dropped.

Answer

The MTU is too small.

Answer

The firewall rules are blocking the traffic.

Answer

The VLAN attachment is down.

Question 3

A company with limited public IP addresses on-premises needs to connect to Google Cloud using Cloud VPN. They require high availability. Which solution should they implement?

Accepted Answer

Use HA VPN with two on-premises public IPs and two tunnels.. HA VPN provides high availability by using two tunnels, each terminating on a separate on-premises VPN gateway with a unique public IP address. This ensures that if one on-premises public IP or tunnel fails, traffic can still flow through the other tunnel, meeting the high-availability requirement. Classic VPN (option B) does not support active-active failover, and using the same public IP for both tunnels (option D) creates a single point of failure at the on-premises side.

Answer

Use NAT to map multiple private IPs to one public IP.

Answer

Use Classic VPN with a single tunnel.

Answer

Use HA VPN with the same public IP for both tunnels.

Question 4

When setting up a Partner Interconnect, which Google Cloud resource is used to connect to the partner's network?

Accepted Answer

VLAN attachment. When setting up a Partner Interconnect, the correct Google Cloud resource is a VLAN attachment. This attachment is provisioned on a Cloud Interconnect connection that is managed by a supported service provider, and it defines the VLAN and the Cloud Router configuration used to exchange routes via BGP. The VLAN attachment is the logical construct that connects your VPC network to the partner's network through the partner's physical infrastructure.

Answer

Cloud VPN gateway

Answer

Cloud Interconnect attachment

Answer

Cloud Router

Question 5

A customer has established a Dedicated Interconnect, but traffic from on-premises to Google Cloud is still using the internet path instead of the interconnect. What is the most likely cause?

Accepted Answer

The BGP routes from on-premises have a lower priority than the default route via internet.. Option D is correct because when both an internet default route and more specific BGP routes from the Dedicated Interconnect exist, the route with the highest administrative distance (lowest priority) wins. By default, static routes or internet-learned routes often have a lower administrative distance (e.g., 1 for static) compared to eBGP routes (AD 20). If the on-premises router is sending BGP routes with a higher AD or the cloud router prefers the internet default route due to route priority, traffic will not use the interconnect.

Answer

The on-premises firewall blocks BGP traffic.

Answer

The Google Cloud Router has not learned any routes.

Answer

The VLAN attachment is in a different region.

Question 6

An organization uses HA VPN with dynamic routing and active-active BGP sessions. One tunnel fails, but traffic continues to flow through the other tunnel. However, they notice increased latency. What is the most likely explanation?

Accepted Answer

BGP multipath is enabled, causing all traffic to be sent through the remaining tunnel.. When BGP multipath is enabled on an HA VPN with active-active BGP sessions, the router can load-balance traffic across multiple tunnels. If one tunnel fails, all traffic is redirected through the remaining tunnel, which can cause increased latency due to congestion or suboptimal path selection. The correct answer is A because this behavior directly explains the latency increase after a tunnel failure.

Answer

The remaining tunnel is using a different encryption algorithm.

Answer

The BGP timers are misconfigured.

Answer

The failed tunnel's routes are still in the routing table.

Question 7

A company needs to connect multiple on-premises sites to Google Cloud using a single Cloud VPN gateway. What is the recommended approach?

Accepted Answer

Create multiple VPN tunnels, each with its own BGP session to a Cloud Router.. When connecting multiple on-premises sites to Google Cloud using a single Cloud VPN gateway, the recommended approach is to create multiple VPN tunnels, each with its own BGP session to a Cloud Router. This allows the Cloud VPN gateway to terminate multiple tunnels, and each tunnel can have a unique BGP session for dynamic route exchange, enabling the gateway to learn and advertise routes for each site independently. Using a single tunnel with multiple BGP sessions or policy-based routing is not supported because a Cloud VPN tunnel is a point-to-point connection that can only have one BGP session per tunnel, and static routes would not provide the redundancy or dynamic failover needed for multiple sites.

Answer

Create a single VPN tunnel and use policy-based routing to direct traffic.

Answer

Use a single VPN tunnel with multiple BGP sessions.

Answer

Create a single VPN tunnel and use static routes for each site.

Question 8

A customer reports that after setting up HA VPN, some on-premises subnets are not reachable from Google Cloud. The Cloud Router shows the missing routes. What is the most likely cause?

Accepted Answer

BGP route filters are blocking the advertisement of those subnets.. Option C is correct because the Cloud Router shows the missing routes, indicating that the VPN tunnel and BGP session are up, but the routes are not being installed. BGP route filters on the Cloud Router or on-premises router can explicitly block the advertisement of specific subnets, preventing them from being learned and installed in the routing table even though the BGP session is established.

Answer

The VPN tunnel is down.

Answer

The on-premises router is not configured to advertise those subnets.

Answer

The shared secret is incorrect.

Question 9

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

Accepted Answer

It depends on the redundancy requirements; typically two per attachment for active-active.. Option A is correct because with a Dedicated Interconnect using two VLAN attachments in different edge availability domains (EADs), the recommended best practice for high availability is to establish two BGP sessions per VLAN attachment (one active and one redundant) on the same Cloud Router, resulting in four sessions total. However, the question asks 'how many BGP sessions should be established' and the correct answer acknowledges that it depends on the redundancy requirements; typically two per attachment for active-active, but if active-passive is acceptable, fewer sessions may suffice. This flexibility makes 'It depends' the most accurate choice.

Answer

Four: two per VLAN attachment.

Answer

Two: one per VLAN attachment.

Answer

One: one session per Cloud Router.

Question 10

Which TWO statements about HA VPN are correct?

Accepted Answer

It supports both active-active and active-passive modes.. Option C is correct because HA VPN supports both active-active and active-passive modes. In active-active mode, both tunnels forward traffic simultaneously, while in active-passive mode, one tunnel is used as a standby. This flexibility allows HA VPN to meet different high-availability and load-balancing requirements.

Answer

Both VPN gateways must be in the same region.

Answer

It uses IKEv1 by default.

Answer

It supports static routing as well as dynamic routing.

Question 11

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

Accepted Answer

Check the MTU size on the VPN tunnel or interconnect.. Option A is correct because an MTU mismatch on the VPN tunnel or interconnect can cause packet fragmentation or drops, leading to BGP session flapping. Cloud Router uses Google's internal infrastructure, and if the MTU is set too low, large BGP update packets may be silently discarded, triggering hold timer expiry and session resets. Checking and adjusting the MTU ensures that BGP packets can traverse the path without fragmentation.

Answer

Delete and recreate the VLAN attachment.

Answer

Revert all BGP routes to static routes.

Answer

Increase the bandwidth of the interconnect.

Question 12

Which THREE components are required to set up a Partner Interconnect connection?

Accepted Answer

A VLAN attachment. A VLAN attachment (option B) is required because it defines the connection between your VPC and the partner's network over a Partner Interconnect, specifying the VLAN ID and IP addressing for the BGP session. Without a VLAN attachment, the Layer 2 and Layer 3 parameters for the interconnect cannot be established.

Answer

A Dedicated Interconnect connection

Answer

A Cloud VPN gateway

Question 13

Your company has a Dedicated Interconnect with two VLAN attachments (vlan-attachment-a and vlan-attachment-b) connected to two different Edge Availability Domains (EADs) in the us-central1 region. Both attachments are associated with a single Cloud Router named 'cr-us-central1'. On-premises, you have two routers (rtr-a and rtr-b) each connected to one VLAN attachment via BGP. The Cloud Router has four BGP sessions: rtr-a (vlan-a), rtr-a (vlan-b), rtr-b (vlan-a), rtr-b (vlan-b) — a full mesh for redundancy. All sessions are established and routes are exchanged. Recently, you added a new on-premises subnet 192.168.100.0/24 and advertised it via BGP from both on-premises routers. However, Google Cloud instances in the VPC cannot reach this subnet. Other on-premises subnets (e.g., 10.0.0.0/8) are reachable. The Cloud Router route table for 'cr-us-central1' shows multiple entries for 192.168.100.0/24, each with different next hops but all with status 'stacked'. There are no BGP route filters configured. What is the most likely cause of the issue?

Accepted Answer

The new subnet 192.168.100.0/24 overlaps with an existing VPC subnet.. When a BGP-learned route overlaps with an existing VPC subnet, Google Cloud treats it as a conflict and marks the route as 'stacked' (i.e., not active). The Cloud Router can learn the route, but it will not be installed in the VPC's effective routes because the VPC subnet prefix takes precedence. Since 192.168.100.0/24 is a private IP range that could easily overlap with a subnet in the VPC, this is the most likely cause.

Answer

The Cloud Router has reached its maximum route limit.

Answer

The BGP routes have incorrect MED values causing a conflict.

Answer

The on-premises routers are not advertising the subnet with a required community tag.

Question 14

A company wants to connect its on-premises data center to Google Cloud. They have a single VPN appliance on-premises and need high availability for the connection. Which architecture provides the most cost-effective high availability solution?

Accepted Answer

Deploy Cloud HA VPN with two interfaces, each with its own external IP address, and configure two tunnels to the on-premises VPN appliance.. Option D is correct because Cloud HA VPN uses two external IP addresses per tunnel and automatically provides high availability by using two VPN gateways in different regions. Option A is incorrect because using two Cloud VPN gateways in the same region does not protect against zonal failure. Option B is incorrect because a single Classic VPN tunnel is not highly available. Option C is incorrect because HA VPN with a single IP per tunnel is not supported; HA VPN requires at least two IPs.

Answer

Use a single Cloud Classic VPN tunnel with a static route.

Answer

Deploy two Cloud Classic VPN gateways in the same region, each with one tunnel to the on-premises VPN appliance.

Answer

Deploy Cloud HA VPN with one interface and one external IP address, and configure a single tunnel to the on-premises appliance.

Question 15

A company is using Dedicated Interconnect to connect their on-premises network to Google Cloud. They have two VLAN attachments configured, each with a separate Cloud Router with active/active BGP. They want to ensure that traffic from their on-premises network to Google Cloud uses both attachments equally. Which configuration should they implement?

Accepted Answer

Set the same MED value on both on-premises BGP peers, and ensure the AS path length is identical.. Option A is correct because setting the same MED (Multi-Exit Discriminator) value on both on-premises BGP peers ensures that Google Cloud's Cloud Routers, which are configured with active/active BGP, will see both paths as equally preferred. When the AS path length is also identical, the BGP best-path selection algorithm on the Cloud Routers will load-balance traffic across both VLAN attachments, achieving equal utilization. This is the standard method for enabling equal-cost multipath (ECMP) over Dedicated Interconnect with multiple attachments.

Answer

Configure local preference on the Cloud Router to prefer one attachment, and rely on the other for backup.

Answer

Configure a single BGP session on one Cloud Router and use static routing for the other attachment.

Answer

Set a higher MED value on one on-premises peer to deprefer that attachment.