PCNE Implementing hybrid interconnectivity Practice Test 9 — 15 Questions

Question 1

After configuring Cloud VPN with dynamic routing (BGP), you notice that on-premises routes are not appearing in Google Cloud. BGP sessions are established but no prefixes are exchanged. Cloud Router logs show: 'No route advertisement received'. On-premises BGP configuration shows 'network 10.0.0.0/8' and 'neighbor 10.1.1.1 remote-as 65000'. What is the most likely cause?

Accepted Answer

The 'network 10.0.0.0/8' command does not have a corresponding exact route in the on-premises routing table; also missing 'neighbor 10.1.1.1 activate' under BGP.. Option A is correct because the on-premises BGP configuration uses the 'network 10.0.0.0/8' command, which requires an exact match in the local routing table to be advertised. Without a route for 10.0.0.0/8 (e.g., a connected or static route), BGP will not advertise it. Additionally, the 'neighbor 10.1.1.1 activate' command is missing under BGP, which is required to enable the exchange of prefixes with that neighbor. These two issues together prevent route advertisement to Google Cloud.

Answer

The on-premises router's BGP peer IP is not in the same subnet as the Cloud Router's interface.

Answer

The Cloud Router's BGP peer IP is not reachable from the on-premises router.

Answer

The BGP MD5 password is configured incorrectly on the on-premises router.

Question 2

A company has a Cloud VPN between their on-premises network and Google Cloud. They want to ensure that traffic flows symmetrically, meaning that traffic from Google Cloud to on-premises uses the same VPN tunnel as traffic from on-premises to Google Cloud. Which best practice should they implement?

Accepted Answer

Implement policy-based routing that forces traffic to and from specific subnets to use the same tunnel.. Option B is correct because policy-based routing (PBR) allows you to explicitly define forwarding rules based on source/destination IP addresses, ensuring that traffic from Google Cloud to on-premises uses the same VPN tunnel as the reverse direction. This enforces symmetric flow, which is critical for stateful firewalls and NAT devices that expect packets to arrive on the same interface they left. Dynamic routing (BGP) or static routes alone do not guarantee symmetry unless combined with PBR or tunnel interface configurations.

Answer

Use dynamic routing with BGP and ensure that the AS path length is the same on both sides.

Answer

Deploy multiple VPN tunnels and use different priorities for each.

Answer

Use static routes pointing to the VPN tunnel on both sides.

Question 3

A company requires a dedicated connection from their on-premises data center to Google Cloud with a guaranteed SLA of 99.99% and bandwidth starting at 10 Gbps. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google Cloud, supporting bandwidths of 10 Gbps or 100 Gbps per circuit. It offers a 99.99% or 99.999% SLA depending on the configuration (e.g., dual connections with diverse paths), meeting the guaranteed SLA and bandwidth requirements specified in the question.

Answer

Direct Peering

Answer

Cloud VPN

Answer

Partner Interconnect

Question 4

An organization has a hybrid network with multiple VPN tunnels connecting their on-premises network to Google Cloud. They use Cloud Router with BGP to propagate routes. They recently added a new subnet 192.168.100.0/24 in Google Cloud. On-premises devices can reach resources in the new subnet, but Google Cloud resources cannot initiate traffic to certain on-premises hosts in the 10.0.0.0/8 subnet. BGP sessions are all established. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking traffic initiated from the 192.168.100.0/24 subnet because it is not in the permitted list.. The issue is that on-premises hosts in 10.0.0.0/8 can be reached from the new Google Cloud subnet (192.168.100.0/24) because BGP routes are propagated, but return traffic initiated from on-premises hosts is blocked by the on-premises firewall. Since BGP sessions are established and routes are exchanged, the problem is not routing but stateful firewall filtering: the on-premises firewall likely has a rule that permits traffic from known subnets but does not include 192.168.100.0/24, so return packets for connections initiated from Google Cloud are dropped.

Answer

The VPC firewall rules are blocking outbound traffic from the new subnet.

Answer

There is a route conflict between the 192.168.100.0/24 route and an existing route in the on-premises routing table.

Answer

The on-premises BGP router is not advertising the 10.0.0.0/8 network because a mask mismatch.

Question 5

Which TWO of the following are benefits of using Cloud Interconnect over Cloud VPN for hybrid connectivity? (Choose two.)

Accepted Answer

Lower and more consistent latency.. Cloud Interconnect provides a dedicated, private connection between your on-premises network and Google Cloud, bypassing the public internet. This results in lower and more consistent latency compared to Cloud VPN, which relies on the public internet and is subject to variable network conditions and potential congestion.

Answer

Always provides encryption for data in transit.

Answer

Easier to set up as no physical connection is needed.

Answer

Lower cost for small bandwidth requirements.

Question 6

Which THREE of the following are requirements for setting up a Dedicated Interconnect connection to Google Cloud? (Choose three.)

Accepted Answer

A Layer 2 circuit between the on-premises router and Google's edge router.. Option A is correct because a Dedicated Interconnect requires a Layer 2 circuit (e.g., Ethernet VLAN) that directly connects your on-premises router to a Google edge router at a colocation facility. This Layer 2 link provides the physical or virtual circuit over which BGP sessions are established to exchange routes between your network and Google Cloud.

Answer

A public IP address on the on-premises router for BGP peering.

Answer

BGP sessions must be configured directly on the VLAN attachment.

Question 7

A Cloud VPN with dynamic routing (BGP) is established between an on-premises network and Google Cloud. The on-premises BGP router is advertising a default route (0.0.0.0/0). The Cloud Router in Google Cloud is receiving this route, but network traffic from Google Cloud VMs to the internet is not being routed through the VPN. Which THREE troubleshooting steps should you take? (Choose three.)

Accepted Answer

Verify that the VPC's dynamic routing mode is set to 'global' if using regional routing.. Option A is correct because the VPC's dynamic routing mode determines the scope of route propagation. If the VPC uses regional dynamic routing, Cloud Router only propagates routes within the region where the VPN tunnel is attached. A global dynamic routing mode is required for the BGP-learned default route to be available across all regions, ensuring VMs in any region can use the VPN for internet egress.

Answer

Check VPC firewall rules to ensure they allow egress traffic from VMs.

Answer

Ensure that the on-premises router is sending the default route with a higher local preference.

Question 8

A multinational company is migrating workloads to Google Cloud and requires a hybrid connectivity solution between their on-premises data centers in New York and London and Google Cloud regions us-central1 and europe-west1. Each data center has a pair of redundant border routers. The network team has set up a Dedicated Interconnect connection in each Google Cloud region, with two VLAN attachments per region (total 4 attachments). Each VLAN attachment is associated with a separate Cloud Router. The Cloud Routers in us-central1 are configured with BGP sessions to the on-premises routers in New York, and the Cloud Routers in europe-west1 peer with the London routers. The VPC is in 'global' dynamic routing mode. After deployment, traffic from on-premises London to Google Cloud in us-central1 takes a suboptimal path: it goes from London to us-central1 via the internet instead of using the Dedicated Interconnect in europe-west1 and then internal Google Cloud backbone. All BGP sessions are up, and routes are being exchanged. The on-premises routers are advertising all their subnets. The Cloud Routers are learning the on-premises prefixes. What is the most likely cause of this suboptimal routing?

Accepted Answer

The on-premises London routers are not receiving routes for the VPC subnets in us-central1, so they send traffic via the internet.. Option B is correct because the on-premises London routers are not receiving routes for the VPC subnets in us-central1. Since the Cloud Routers in europe-west1 only peer with London, they must advertise the us-central1 VPC subnets to London via BGP. If those routes are missing, London has no path via the Dedicated Interconnect and falls back to the internet. The VPC is in global dynamic routing mode, so Cloud Routers in both regions learn all VPC subnets, but the europe-west1 Cloud Router must explicitly advertise them to London.

Answer

The VPC subnets in us-central1 are using smaller prefixes that are not being summarized by the Cloud Router.

Answer

The Cloud Router in europe-west1 is prepending AS path for routes coming from us-central1, making them less preferred.

Answer

The on-premises New York routers are setting a lower MED for routes to us-central1, causing London to deprefer them.

Question 9

A company has set up a Cloud VPN with dynamic routing (BGP) between their on-premises network (AS 65001) and Google Cloud (AS 64514). They are using Cloud Router with a regional dynamic routing mode. The on-premises router is advertising a subnet 10.1.0.0/16. The Google Cloud VPC has subnet 10.2.0.0/16 in the same region as the Cloud Router. Both subnets are unique. The connection has been working for months. However, after a recent maintenance window, the on-premises router started experiencing BGP flapping with the Cloud Router. The Cloud Router logs show 'BGP notification sent: Hold timer expired'. The on-premises router logs show similar errors. The network team has verified that the VPN tunnel is established and stable. What is the most likely cause of the BGP flapping?

Accepted Answer

The on-premises router's BGP hold timer is set to 30 seconds, but the Cloud Router's hold timer is set to 180 seconds.. The BGP hold timer defines the maximum time a router waits to receive a keepalive or update message from a peer before declaring the session dead. When the on-premises router uses a hold timer of 30 seconds and the Cloud Router uses 180 seconds, the on-premises router expects keepalives every 10 seconds (one-third of hold time). If the Cloud Router sends keepalives at its own negotiated interval (e.g., 60 seconds based on its hold timer), the on-premises router will not receive them within its 30-second window, causing it to send a 'Hold timer expired' notification and flap the BGP session. The VPN tunnel remains stable because the issue is at the BGP session layer, not the underlying tunnel.

Answer

The VPN tunnel's MTU is set to 1500 bytes, but BGP packets are larger and are being fragmented.

Answer

The Cloud Router's BGP keepalive interval is set to 30 seconds, while the on-premises router is using 10 seconds.

Answer

The on-premises router is advertising too many routes, causing the Cloud Router to run out of memory.

Question 10

A small company is moving their on-premises application to Google Cloud. They have a single on-premises office with a small router that supports IPsec VPN. They need a simple and low-cost connectivity solution that provides encryption and a consistent experience. They anticipate low bandwidth needs (under 100 Mbps). They also want the ability to use BGP for dynamic routing to avoid manual route updates. Which Google Cloud service should they use?

Accepted Answer

Cloud HA VPN with dynamic routing (BGP). Cloud HA VPN with dynamic routing (BGP) is the correct choice because it provides an encrypted IPsec tunnel, supports BGP for automatic route exchange, and is a low-cost, simple solution for sub-100 Mbps bandwidth needs. It meets the requirement for a consistent experience without the complexity or cost of dedicated interconnect services.

Answer

Partner Interconnect

Answer

Cloud Classic VPN with static routes

Answer

Direct Peering

Question 11

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They have two VLAN attachments (vlan-100 and vlan-200) connected to two separate Cloud Routers in the same region. Each Cloud Router has a BGP session with the on-premises router. The on-premises router advertises the same prefixes (10.0.0.0/8) over both sessions. In Google Cloud, they have workloads in two different VPCs: VPC-A and VPC-B. They want traffic to VPC-A to use vlan-100, and traffic to VPC-B to use vlan-200. Cloud Router 1 is attached to VPC-A, Cloud Router 2 is attached to VPC-B. Currently, traffic from on-premises to VPC-A sometimes goes through vlan-200, causing asymmetric routing. What configuration change should they make to ensure traffic is symmetric?

Accepted Answer

Use BGP community tags on the on-premises router to label routes for VPC-A and VPC-B, and configure route priority on Cloud Router to match these communities.. Option D is correct because BGP community tags allow the on-premises router to tag routes for VPC-A and VPC-B differently. Cloud Router can then use these community tags to influence route priority (e.g., via local preference or MED matching), ensuring that traffic to VPC-A is always routed through vlan-100 and traffic to VPC-B through vlan-200, solving the asymmetric routing issue without relying on static routes or MED manipulation that would affect all traffic.

Answer

Set a higher MED on the on-premises router for routes advertised to vlan-200, making vlan-100 preferred for all traffic.

Answer

Configure static routes on the on-premises router to force traffic to VPC-A via vlan-100 and to VPC-B via vlan-200.

Answer

Create two separate VPCs and assign each VLAN attachment to a different VPC.

Question 12

A large enterprise has multiple on-premises data centers connected to Google Cloud via a combination of Dedicated Interconnect and Cloud VPN. They have a VPC with subnets in us-east1 and us-west1. The on-premises network advertises a prefix 10.0.0.0/8 to both Cloud Routers (each in different regions) via BGP. The Cloud Routers are configured with 'global' dynamic routing mode. The network team notices that traffic from Google Cloud instances in us-west1 to on-premises destinations in 10.0.0.0/8 is always taking the path to the closest on-premises data center (west coast) even though the west coast data center is currently under high load, causing performance degradation. The east coast data center is underutilized. They want to influence the path selection so that the west coast instances prefer the east coast data center during peak times. They are using BGP. What is the most effective method to achieve this?

Accepted Answer

Use BGP communities to tag routes from the west coast data center under load, and configure Cloud Router to match these communities and adjust the route priority (MED) accordingly.. Option D is correct because BGP communities allow the west coast data center to tag its routes with a community value indicating high load. The Cloud Router can then be configured to match this community and adjust the route priority by lowering the MED (or local preference) for those routes, making the east coast data center's routes more preferred. This dynamic, policy-based approach directly addresses the need to shift traffic away from the overloaded west coast data center without manual reconfiguration.

Answer

Set a higher local preference on the west coast Cloud Router for routes received from the east coast data center.

Answer

Set a higher MED on the west coast data center's BGP advertisements to increase its desirability.

Answer

Configure the east coast data center to prepend one additional AS path hop to its advertised routes.

Question 13

A company has deployed Cloud HA VPN between their on-premises network and Google Cloud. They have two tunnels from the on-premises VPN appliance to the HA VPN gateway. The on-premises appliance uses a single public IP address for both tunnels, while the Cloud VPN gateway uses two different public IPs. BGP sessions are established over both tunnels, and the Cloud Router is configured with 'active/active' mode. The network team notices that all outbound traffic from Google Cloud to on-premises is using only one of the two tunnels, even though both tunnels are up. BGP metrics are identical for routes received over both sessions. What is the most likely cause?

Accepted Answer

The Cloud Router does not support ECMP when both BGP sessions have the same peer IP address.. Option C is correct because Cloud Router uses the BGP peer IP address as part of the ECMP hash key. When both BGP sessions originate from the same on-premises public IP (the single IP used for both tunnels), Cloud Router sees them as the same peer and does not load-balance across them. Even though the tunnels use different Cloud VPN gateway IPs, the BGP sessions share a common peer IP, which prevents ECMP from being enabled.

Answer

The BGP sessions have different hold timers causing one to be preferred.

Answer

The on-premises appliance must use two different public IPs for ECMP to work.

Answer

The Cloud Router must be configured with 'active/standby' mode instead of 'active/active'.

Question 14

A company is planning to connect their on-premises data center to Google Cloud. They require high bandwidth (10 Gbps) and low latency for real-time data replication. They also want a cost-effective solution that supports burstable traffic. Which TWO connectivity options should they consider? (Choose TWO.)

Accepted Answer

Partner Interconnect. Partner Interconnect (Option C) is correct because it provides dedicated, high-bandwidth connections (up to 10 Gbps per circuit) with low latency, suitable for real-time data replication, and supports burstable traffic through a service provider's network, offering a cost-effective alternative to Dedicated Interconnect for enterprises that need flexibility without full physical infrastructure ownership.

Answer

Classic VPN (route-based VPN)

Answer

Cloud VPN (IPsec VPN)

Answer

Direct Peering

Question 15

Your organization has a site-to-site Cloud VPN connection between an on-premises network with CIDR 10.0.0.0/8 and a VPC in us-central1 with subnet 192.168.1.0/24. The VPN tunnel is established, but you cannot reach a Compute Engine instance with internal IP 192.168.1.10 from a server on-premises with IP 10.0.0.50. Cloud VPN logs show no errors. On-premises firewall rules allow all outbound traffic. What is the most likely cause of the problem?

Accepted Answer

Missing a static route on the on-premises router for 192.168.1.0/24 pointing to the VPN gateway. The VPN tunnel is established and Cloud VPN logs show no errors, indicating the cloud side is configured correctly. However, the on-premises server at 10.0.0.50 cannot reach 192.168.1.10 because the on-premises router lacks a static route for the VPC subnet 192.168.1.0/24 pointing to the VPN gateway. Without this route, the on-premises router does not know to send traffic destined for 192.168.1.0/24 through the VPN tunnel, so packets are dropped or sent to the default gateway instead.

Answer

A firewall rule on the VPC blocking inbound traffic from 10.0.0.0/8

Answer

The Compute Engine instance's OS firewall blocking ICMP

Answer

Incorrect IAM permissions on the Cloud VPN gateway