PCNE Implementing Hybrid Interconnectivity — 15 Questions

Question 1

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have already ordered a cross-connect from their co-location facility to a Google Point of Presence (PoP). What is the NEXT step to establish the connection?

Accepted Answer

Create a VLAN attachment in Google Cloud. After the physical cross-connect is in place, the next step is to create a VLAN attachment in the Cloud Console or via gcloud. The VLAN attachment is the logical construct that represents the connection between the on-premises router and the Cloud Router.

Answer

Create a Cloud Router and BGP session

Answer

Run a ping test to verify connectivity

Answer

Configure BGP on the on-premises router

Question 2

An organization is connecting their on-premises data center to Google Cloud via Partner Interconnect. The partner offers both Layer 2 and Layer 3 connectivity options. The organization wants to manage their own BGP sessions and IP addressing. Which connectivity option should they choose?

Accepted Answer

Layer 2 connectivity. With Layer 2, the service provider delivers a transparent VLAN, and the customer manages the BGP session with Google Cloud Router. Layer 3 would mean the partner manages the routing, which is not desired here.

Answer

Any Layer option because they can manage BGP regardless

Answer

Neither; they must use Dedicated Interconnect

Answer

Layer 3 connectivity

Question 3

A company has deployed an HA VPN gateway in Google Cloud to connect to their on-premises network. They have configured two tunnels with IKEv2 and BGP. One tunnel is established, but the second tunnel is not coming up. What could be a likely cause?

Accepted Answer

The pre-shared keys are mismatched between the two tunnels. Common issues include mismatched pre-shared keys or IKE versions. Since the first tunnel works, the configuration is mostly correct, but the second tunnel may have a different pre-shared key or PSK mismatch. Incorrect IKE version is less likely because both tunnels use the same gateway. BGP timers are usually consistent. Cloud VPN logs would help identify the root cause.

Answer

IKE version is set to IKEv1 on one side

Answer

The second tunnel's peer IP is unreachable

Answer

BGP timers are inconsistent

Question 4

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. Both connections are active and they want to use both simultaneously for load balancing traffic. They have configured two VLAN attachments each with a Cloud Router and BGP sessions. How should they configure BGP to achieve active-active load sharing?

Accepted Answer

Configure the on-premises router to enable ECMP for the BGP routes. Equal-cost multipath (ECMP) requires that the routes from both connections have the same next-hop attribute and are learned via different BGP sessions. By default, Cloud Router advertises the same routes with the same MED and AS path. To enable ECMP, the on-premises router must be configured to accept multiple equal-cost paths. The Cloud Router will automatically advertise routes with identical attributes when using separate VLAN attachments, and the on-premises router can then load balance.

Answer

Set different local preference values on the Google Cloud Router

Answer

Use AS path prepending on one connection to make it less preferred

Answer

Assign different MED values to each connection to influence preference

Question 5

An engineer needs to set up DNS resolution for on-premises resources from Google Cloud. They want to resolve a custom domain (e.g., corp.example.com) using on-premises DNS servers. Which Cloud DNS feature should they use?

Accepted Answer

DNS forwarding zone. DNS forwarding zones in Cloud DNS allow you to forward queries for a specific domain to a set of on-premises DNS server IPs. This is achieved by creating a forwarding zone with the target name servers pointing to the on-premises DNS servers.

Answer

Cloud DNS peering

Answer

Outbound DNS forwarding

Answer

Inbound DNS policy

Question 6

A company has a HA VPN gateway in Google Cloud with two tunnels to their on-premises router. They want to ensure that if one tunnel fails, all traffic automatically fails over to the other tunnel. What configuration is necessary on the on-premises router?

Accepted Answer

Set a higher local preference on the primary tunnel. For failover, the on-premises router should prefer one tunnel over the other using BGP attributes like local preference or AS path prepending. Typically, one tunnel is primary and the other is backup. Both tunnels should be established with BGP sessions, and the on-premises router should learn the same routes from both, but with different local preference values to determine the primary path.

Answer

Use AS path prepending on the primary tunnel to make it preferred

Answer

Configure the same MED value on both tunnels

Answer

Configure ECMP to load balance across both tunnels

Question 7

A network engineer is setting up a Dedicated Interconnect with a 10 Gbps circuit. They need to achieve 99.99% availability SLA. Which of the following configurations meets the SLA requirements?

Accepted Answer

Two 10 Gbps circuits in different metro areas. Google Cloud's 99.99% SLA for Dedicated Interconnect requires two connections from two different metro areas (redundant locations). Each connection must be 10 Gbps or more. Active-active or active-passive is acceptable, but the key is two circuits in different metros.

Answer

One 10 Gbps circuit and one VPN as backup

Answer

Single 10 Gbps circuit in one metro area

Answer

Two 10 Gbps circuits in the same metro area

Question 8

A company is using Partner Interconnect with a service provider that requires the use of VLAN attachments. Which type of VLAN attachment should they create in Google Cloud to use the partner's connection?

Accepted Answer

PARTNER. For Partner Interconnect, you create a VLAN attachment of type PARTNER. This attachment represents the logical connection to the partner's network. The partner can also use PARTNER_PROVIDER type if they manage the attachment, but from the customer side, it's PARTNER.

Answer

DEDICATED

Answer

PARTNER_PROVIDER

Answer

CUSTOMER

Question 9

A company has set up a route-based HA VPN tunnel between Google Cloud and their on-premises network. They are experiencing packet loss and need to troubleshoot. Which logs or metrics would provide the MOST relevant information to diagnose the issue?

Accepted Answer

Cloud VPN gateway logs (syslog). Cloud VPN gateway logs provide detailed information about tunnel establishment, IKE negotiations, and BGP messages. They can help identify packet loss causes like MTU issues, encryption mismatches, or routing problems. Cloud Monitoring metrics for VPN tunnels show traffic volume and errors, but logs provide more granular detail.

Answer

Cloud Monitoring metric: interconnect/network/received_bytes_count

Answer

Cloud Load Balancing logs

Answer

VPC flow logs

Question 10

An organization has a Dedicated Interconnect with one VLAN attachment. They want to add a second VLAN attachment on the same interconnect circuit for additional capacity. What is the correct approach?

Accepted Answer

Create a second VLAN attachment with a different VLAN ID. A single Dedicated Interconnect circuit can have multiple VLAN attachments (up to 8 for 10 Gbps, up to 64 for 100 Gbps). You simply create another VLAN attachment on the same interconnect, using a different VLAN ID and a different Cloud Router if desired.

Answer

Order a second physical cross-connect

Answer

Upgrade the existing VLAN attachment to increase bandwidth

Answer

Create a new Cloud Router and associate it with the existing VLAN attachment

Question 11

A company has deployed a Cloud VPN tunnel using route-based VPN (using IKEv2) and has configured BGP on the tunnel. The tunnel is up, but the BGP session is not establishing. What is a likely cause?

Accepted Answer

The BGP IP addresses are not reachable over the tunnel. For route-based VPN tunnels, BGP peering requires that the Cloud VPN gateway and the on-premises router can reach each other's BGP IP addresses. The BGP IPs are typically link-local addresses derived from the tunnel's interface. If the BGP session is not establishing, common issues include incorrect BGP IP configuration, firewall rules blocking BGP (port 179), or the tunnel not passing traffic correctly.

Answer

IKE version mismatch

Answer

The pre-shared key is incorrect

Answer

The Cloud Router is not configured

Question 12

A company wants to use AS path prepending to influence traffic from Google Cloud to their on-premises network to prefer one Dedicated Interconnect connection over another. How should they configure AS path prepending?

Accepted Answer

Configure AS path prepending on the on-premises router for the routes advertised to Google Cloud. AS path prepending is done on the on-premises router by adding the on-premises AS number multiple times in the BGP updates sent to Google Cloud. Google Cloud Router will then prefer the path with the shorter AS path length (fewer prepends). To make one connection less preferred, the on-premises router should prepend AS numbers on the BGP updates sent over that connection.

Answer

Configure AS path prepending on the Cloud Router for the routes advertised to on-premises

Answer

Configure AS path prepending on both sides equally

Answer

Use MED instead of AS path prepending

Question 13

A company needs to connect their on-premises network to Google Cloud with high availability and load balancing across multiple tunnels. They plan to use HA VPN. Which TWO of the following are required to achieve active-active load balancing across multiple tunnels?

Accepted Answer

Configure the on-premises router to enable ECMP. For active-active load balancing, Cloud Router BGP must advertise the same routes with identical attributes, and the on-premises router must support ECMP. Often, two tunnels are configured as a pair. The on-premises router must be configured to accept equal-cost routes.

Answer

Use AS path prepending on one tunnel

Answer

Use different MED values for each tunnel

Answer

Configure static routes instead of BGP

Question 14

An organization is setting up a Dedicated Interconnect and wants to monitor the health and performance of the connection using Cloud Monitoring. Which THREE metrics are available for Dedicated Interconnect?

Accepted Answer

interconnect/network/received_bytes_count. Cloud Monitoring provides several metrics for Dedicated Interconnect, including traffic volume (received_bytes_count), link operational status, and packet loss. VLAN attachment metrics are also available, but the question asks for interconnect metrics.

Answer

interconnect/network/traffic_drops

Answer

interconnect/vpn/tunnel_status

Question 15

A company is deploying Cloud DNS to enable on-premises resources to resolve Google Cloud private zone names. Which TWO resources are required for this setup?

Accepted Answer

Inbound DNS policy. To allow on-premises DNS queries to reach Google Cloud private zones, you need an inbound DNS policy that creates a forwarding IP address in a VPC, and you need to configure on-premises DNS servers to forward those queries to that IP. A forwarding zone is used for the opposite direction (GCP to on-premises).

Answer

VPC peering

Answer

Cloud Router

Answer

Outbound DNS forwarding zone