PCNE Implementing Hybrid Interconnectivity — 15 Questions

Question 1

A company has a Hybrid Connectivity setup using Cloud VPN with dynamic routing (BGP). They notice that traffic from their on-premises network to Google Cloud is intermittently dropping. The on-premises BGP speaker is sending routes with a higher local preference (200) than the Google Cloud router (default 100). What is the most likely cause of the intermittent drops?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asymmetric routing is causing traffic to be dropped by stateful firewalls. The on-premises BGP speaker is sending routes with a higher local preference (200) than the default on Cloud Router (100). This makes the on-premises route preferred for return traffic from Google Cloud, but the forward traffic from on-premises may still use the Cloud VPN tunnel. This asymmetry causes stateful firewalls (e.g., on-premises firewall or Google Cloud firewall) to drop packets that do not match an existing session, leading to intermittent drops.

Answer

AS path prepending is causing route flapping

Answer

Cloud Router is not configured for ECMP

Answer

The BGP MED attribute is misconfigured

Question 2

An organization wants to migrate legacy on-premises applications to Google Cloud but must maintain low-latency connectivity for real-time data synchronization. The on-premises data center is in a colocation facility that is not directly served by Google Cloud. Which hybrid connectivity option is most cost-effective while meeting the latency requirement?

Accepted Answer

Partner Interconnect. Partner Interconnect is the most cost-effective option because it provides a dedicated, low-latency connection through a supported service provider that can extend connectivity from the colocation facility to a Google Cloud region. Unlike Dedicated Interconnect, it does not require physical cross-connects in a Google Cloud colocation facility, making it ideal when the on-premises site is not directly served by Google Cloud. It meets the real-time synchronization latency requirement by offering a reliable, high-bandwidth connection with SLA-backed uptime.

Answer

Direct Peering

Answer

Cloud VPN with dynamic routing

Answer

Dedicated Interconnect

Question 3

A company is using Cloud VPN with BGP to connect their on-premises network to Google Cloud. They have two VPN tunnels from two different on-premises VPN gateways to a single Cloud VPN gateway. They notice that during maintenance on one on-premises gateway, traffic fails over to the other tunnel, but after the maintenance, traffic does not fail back. What is the most likely cause?

Accepted Answer

The BGP local preference on the primary tunnel is not higher than the backup tunnel. B is correct because BGP local preference is used to influence outbound traffic path selection. If the primary tunnel's local preference is not higher than the backup tunnel, BGP will not prefer the primary route after the backup session recovers, causing traffic to remain on the backup tunnel. This is a classic BGP route selection behavior where the highest local preference wins.

Answer

Only one VPN tunnel can be active at a time

Answer

Cloud VPN gateway does not support BGP

Answer

The backup tunnel does not have a valid BGP session

Question 4

A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?

Accepted Answer

Enable MACsec on the Dedicated Interconnect. MACsec (IEEE 802.1AE) provides Layer 2 encryption on the Dedicated Interconnect link itself, encrypting all traffic between the on-premises router and the Google Cloud edge router without requiring any changes to applications or additional VPN gateways. This meets the encryption requirement with minimal overhead and complexity because MACsec operates transparently at the data link layer, adding negligible latency and no per-packet processing overhead compared to IPsec or TLS.

Answer

Enable TLS encryption on all applications

Answer

Use Cloud VPN over the internet instead of Dedicated Interconnect

Answer

Establish an IPsec VPN tunnel over the Dedicated Interconnect

Question 5

An enterprise is using a 10 Gbps Dedicated Interconnect between their on-premises data center and Google Cloud. They measure throughput and find it is only 5 Gbps even though there is no congestion. The on-premises router is configured with a single VLAN attachment. What is the most likely cause?

Accepted Answer

The on-premises router does not support full line rate. A single VLAN attachment on a 10 Gbps Dedicated Interconnect means the on-premises router must handle all traffic through one physical interface. If the router lacks the forwarding capacity to process packets at 10 Gbps line rate, throughput will be capped at its maximum switching or routing performance, which in this case is 5 Gbps. This is a common hardware limitation, not a configuration or congestion issue.

Answer

BGP is not configured, causing routing loop

Answer

MTU mismatch between on-premises and Google Cloud

Answer

QoS policy is limiting throughput on Google Cloud side

Question 6

A company is planning to connect multiple VPCs in different regions to their on-premises network using a single Dedicated Interconnect. Which TWO configurations are required to achieve this?

Accepted Answer

Create a Cloud Router in each VPC. Option C is correct because Dedicated Interconnect requires a Cloud Router in each VPC network that will use the interconnect; the Cloud Router provides BGP peering and dynamic route exchange for that VPC, and a single Cloud Router cannot serve multiple VPCs. Option E is correct because each VPC needs its own VLAN attachment (an interconnect attachment) on the Dedicated Interconnect connection, since a VLAN attachment is bound to one VPC network and one Cloud Router; multiple attachments allow multiple VPCs to share the single physical connection. Option A is wrong because a Cloud Router is regional and scoped to a single VPC, so one Cloud Router cannot serve all VPCs. Option B is wrong because Cloud VPN tunnels are not required for Dedicated Interconnect connectivity and would be a separate, redundant solution. Option D is wrong because VLAN attachments are regional resources, not global, so a 'global VLAN attachment' is not a valid configuration.

Answer

Create a single Cloud Router for all VPCs

Answer

Set up Cloud VPN tunnels for regional connectivity

Answer

Use a global VLAN attachment

Question 7

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

Accepted Answer

Confirm that the subnet routes for the instance IP ranges are present in the VPC. Option B is correct because, even when the VLAN attachment IP is reachable, Compute Engine instances are only reachable if the VPC has subnet routes covering the instances' IP ranges; missing or withdrawn subnet routes (for example, due to route advertisement or peering issues) will black-hole traffic to the instances. Option C is correct because VPC firewall rules must explicitly permit ingress traffic from the on-premises source subnets to the instances; if no allow rule matches the source ranges and target instances, packets are dropped even though the VLAN attachment itself is pingable. Option A is not relevant because IAM controls API-level permissions to manage or access resources, not packet-level network connectivity to instances. Option D is incorrect because the VLAN attachment (Cloud Interconnect) IP is not required to be in the same subnet as the instances; the VLAN attachment is a link-layer construct and routing handles reachability. Option E is not the best check here because the scenario states the VLAN attachment IP can already be pinged, which implies the BGP sessions and Cloud Router are functioning and routes are being exchanged.

Answer

Verify that the on-premises network has IAM permissions to access instances

Answer

Ensure that the VLAN attachment IP is in the same subnet as the instances

Answer

Check that BGP sessions are established between Cloud Router and on-premises router

Question 8

A company is using Cloud Interconnect with multiple VLAN attachments. They want to implement traffic shaping to prioritize real-time traffic over bulk transfers. Which THREE actions should they take?

Accepted Answer

Set up Cloud Router with BGP QoS policies to match DSCP values. Option A is correct because Cloud Router supports BGP QoS policies that can match DSCP values, allowing the network to classify and prioritize real-time traffic over bulk transfers across the Interconnect VLAN attachments. Option C is correct because VPC firewall rules can classify traffic based on source and destination, which is a necessary step to identify and separate real-time traffic from bulk transfers before applying prioritization. Option D is correct because DSCP markings must be set on the on-premises routers so that the traffic types are tagged consistently end-to-end, enabling the Cloud Router BGP QoS policies to match those DSCP values. Option B is not correct because Cloud NAT provides outbound internet address translation and port allocation, not traffic shaping or prioritization. Option E is not correct because VPC flow logs are for observability and identifying heavy traffic flows, not for implementing traffic shaping or prioritization.

Answer

Enable Cloud NAT to handle traffic shaping

Answer

Use VPC flow logs to identify heavy traffic flows

Question 9

A large e-commerce company has a hybrid cloud setup with a Dedicated Interconnect between their on-premises data center in Dallas and Google Cloud us-central1 region. They have a single VLAN attachment with a Cloud Router that uses BGP to exchange routes. The on-premises network uses 10.0.0.0/8, and Google Cloud VPC uses 172.16.0.0/16. They recently deployed a new application in us-west1 that uses IP range 172.17.0.0/16. They created a VPC peering between the us-central1 VPC and the us-west1 VPC. On-premises users can reach the us-central1 workloads but cannot reach the us-west1 application. There are no firewall rules blocking traffic. The on-premises router has a default route pointing to the Interconnect. What is the most likely cause of the issue?

Accepted Answer

The Cloud Router does not have routes for 172.17.0.0/16 because VPC peering does not automatically propagate routes to Cloud Router. The issue is that VPC peering does not automatically propagate routes from the peered VPC (us-west1, 172.17.0.0/16) to the Cloud Router that is used for the Dedicated Interconnect. Cloud Router only learns routes that are present in the VPC’s routing table and that are explicitly advertised via BGP. Since VPC peering routes are not automatically imported into the VPC’s dynamic routing table for Cloud Router, the on-premises router never receives a route for 172.17.0.0/16, even though there are no firewall blocks.

Answer

BGP is not configured between Cloud Router and us-west1 VPC

Answer

Firewall rules in us-west1 are blocking traffic from the on-premises IP range

Answer

The Dedicated Interconnect is only available in us-central1 and cannot reach us-west1

Question 10

A company needs to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have a service level agreement that requires 99.99% availability for the connection. What is the minimum number of VLAN attachments they must provision, and how should they be configured to meet this SLA?

Accepted Answer

Two VLAN attachments, each on a different Interconnect. To achieve 99.99% availability for Dedicated Interconnect, you must eliminate single points of failure. A single VLAN attachment on one Interconnect (Option A) provides no redundancy. Google Cloud requires at least two VLAN attachments, each on a different Interconnect (and ideally different edge availability domains), to meet this SLA. This ensures that if one Interconnect or VLAN attachment fails, traffic can fail over to the other, maintaining connectivity.

Answer

One VLAN attachment with a single Interconnect

Answer

Four VLAN attachments on two Interconnects

Answer

Two VLAN attachments on the same Interconnect

Question 11

A company wants to migrate a legacy application to Google Cloud that requires low-latency communication with on-premises databases. The application is latency-sensitive and must use private IP addresses only. Which hybrid connectivity solution should they choose?

Accepted Answer

Partner Interconnect. Partner Interconnect is the correct choice because it provides a dedicated, high-bandwidth connection with low latency, supports private IP addresses, and meets the requirement for latency-sensitive communication with on-premises databases. Unlike other options, it offers a Service Level Agreement (SLA) for uptime and performance, ensuring consistent low-latency connectivity.

Answer

Cloud VPN

Answer

Carrier Peering

Answer

Direct Peering

Question 12

An organization has multiple VPCs in Google Cloud that need to communicate with an on-premises network through a single Dedicated Interconnect. All VPCs are in the same project. What is the most efficient way to enable connectivity from all VPCs to on-premises?

Accepted Answer

Create a Cloud Router per VPC, each with its own VLAN attachment on the same Interconnect. Each VPC requires its own Cloud Router and VLAN attachment to establish a dedicated BGP session over the same Dedicated Interconnect. This allows multiple VPCs in the same project to share a single physical interconnect while maintaining separate Layer 3 routing domains. A single VLAN attachment cannot be shared across VPCs, as each attachment is associated with exactly one Cloud Router and one VPC.

Answer

Create a separate Interconnect for each VPC

Answer

Create a single VLAN attachment and use it for all VPCs

Answer

Use VPC Network Peering to connect VPCs and attach one VPC to Interconnect

Question 13

A network engineer is troubleshooting connectivity between an on-premises network and Google Cloud. The on-premises router has two BGP sessions configured for redundancy with a Cloud Router. The engineer runs the command above. Which issue does the output indicate?

Accepted Answer

The on-premises router is not advertising any routes to the Cloud Router. The output shows that both BGP sessions are established (state = Established), so options A and B are incorrect. However, the 'Received routes' count is 0 for both peers, meaning the on-premises router is not sending any routes to the Cloud Router. This prevents the Cloud Router from learning the on-premises prefixes, breaking connectivity from Google Cloud to on-premises.

Answer

Both BGP sessions are down

Answer

The BGP session for peer-a is down

Answer

The Cloud Router is not advertising any routes to on-premises

Question 14

A company is designing a hybrid network with Partner Interconnect. They need to ensure high availability and meet a 99.99% SLA. Which TWO actions should they take?

Accepted Answer

Provision two Partner Interconnects from different providers or locations. Option A is correct because Google Cloud's 99.99% Partner Interconnect SLA requires redundancy at the interconnect level, and provisioning two Partner Interconnects from different providers or locations eliminates a single point of failure in the physical path. Option B is correct because each interconnect must be paired with its own VLAN attachment (each attachment maps to a distinct interconnect), so creating two VLAN attachments on different interconnects provides the redundant logical connectivity needed to achieve the 99.99% SLA. Option C is not required for the SLA and is a lower-bandwidth contingency, not a redundant high-availability interconnect design. Option D is insufficient because a single VLAN attachment, even with multiple BGP sessions, still shares one physical interconnect and cannot meet the 99.99% availability target. Option E is also insufficient because two VLAN attachments on a single Partner Interconnect still depend on one physical connection, leaving a single point of failure.

Answer

Enable VPN as a backup to the Interconnect

Answer

Create a single VLAN attachment with multiple BGP sessions

Answer

Provision a single Partner Interconnect with two VLAN attachments

Question 15

An organization is using Cloud VPN with dynamic routing and wants to improve failover time between two VPN tunnels. Which THREE configuration changes can help reduce failover time?

Accepted Answer

Set a lower BGP MED value on the primary tunnel. Option A is correct because BGP MED (Multi-Exit Discriminator) is used to influence path preference; setting a lower MED on the primary tunnel makes it the preferred path, so when it fails, traffic can quickly shift to the secondary tunnel. Option C is correct because reducing BGP keepalive and hold timers allows faster detection of a failed peer, which directly shortens failover time. Option E is correct because using multiple VPN tunnels with equal BGP metrics enables ECMP-style load sharing and immediate failover—if one tunnel goes down, traffic continues over the remaining equal-cost tunnels without waiting for BGP reconvergence. Option B is incorrect because increasing the keepalive interval slows failure detection, which would increase failover time. Option D is incorrect because static routes with higher priority than BGP routes would override dynamic routing and prevent BGP from properly failing over between tunnels.

Answer

Increase the BGP keepalive interval to reduce overhead

Answer

Add static routes with a higher priority than BGP routes