PCNE Implementing Hybrid Interconnectivity Practice Test 10 — 15 Questions

Question 1

Your organization has a site-to-site Cloud VPN connection between an on-premises network with CIDR 10.0.0.0/8 and a VPC in us-central1 with subnet 192.168.1.0/24. The VPN tunnel is established, but you cannot reach a Compute Engine instance with internal IP 192.168.1.10 from a server on-premises with IP 10.0.0.50. Cloud VPN logs show no errors. On-premises firewall rules allow all outbound traffic. What is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Missing a static route on the on-premises router for 192.168.1.0/24 pointing to the VPN gateway. The VPN tunnel is established and Cloud VPN logs show no errors, indicating the cloud side is configured correctly. However, the on-premises server at 10.0.0.50 cannot reach 192.168.1.10 because the on-premises router lacks a static route for the VPC subnet 192.168.1.0/24 pointing to the VPN gateway. Without this route, the on-premises router does not know to send traffic destined for 192.168.1.0/24 through the VPN tunnel, so packets are dropped or sent to the default gateway instead.

Answer

A firewall rule on the VPC blocking inbound traffic from 10.0.0.0/8

Answer

The Compute Engine instance's OS firewall blocking ICMP

Answer

Incorrect IAM permissions on the Cloud VPN gateway

Question 2

A financial institution is setting up Dedicated Interconnect with Google Cloud. They have two on-premises routers (R1 and R2) each connected to a separate Google Cloud router via VLAN attachments in two different zones (us-central1-a and us-central1-b). The on-premises routers are configured with BGP, and they advertise the corporate prefix 10.0.0.0/8. Google Cloud routers are configured with custom route advertisements. After provisioning, you notice that traffic from some on-premises subnets to GCP experiences asymmetrical routing, causing packet drops. You verify that both BGP sessions are established and that both Cloud Routers have received the 10.0.0.0/8 route. What is the most likely cause of the asymmetrical routing?

Accepted Answer

On-premises routers have mismatched BGP local preference values for routes received from Google Cloud. Asymmetrical routing in a dual-homed Dedicated Interconnect setup occurs when on-premises routers have different BGP local preference values for routes received from Google Cloud. Local preference is the first BGP attribute considered when selecting the best path outbound from the on-premises network. If R1 has a higher local preference for the GCP routes than R2, all outbound traffic from on-premises will prefer R1, while return traffic from GCP may arrive via either router (depending on GCP's routing), causing a mismatch in traffic paths and packet drops.

Answer

The on-premises routers are using the same AS number causing BGP loop prevention

Answer

VLAN attachments are configured with different MTU sizes

Answer

Cloud Router is setting different BGP metric attributes for each VLAN attachment

Question 3

A company currently uses a site-to-site Cloud VPN (IPsec) to connect their on-premises network to a VPC. Due to growing bandwidth demands, they plan to migrate to Partner Interconnect using a supported service provider. They have ordered a 1 Gbps connection and the provider has indicated the VLAN attachment is ready. After creating the VLAN attachment and pairing it with a Cloud Router, the on-premises router sees the BGP session come up, but no traffic is forwarded over the interconnect. The Cloud VPN is still operational. What step is most likely missing?

Accepted Answer

Adjust the BGP metric (MED) on the Cloud Router for the Partner Interconnect VLAN attachment to be lower than the VPN route. When both a Cloud VPN and a Partner Interconnect are connected to the same VPC, the Cloud Router will have multiple BGP routes for the same destination prefixes. By default, the VPN BGP session may have a lower MED (Multi-Exit Discriminator) or a higher local preference, causing traffic to prefer the VPN path. Lowering the MED on the VLAN attachment's BGP session makes the interconnect route more preferred, allowing traffic to be forwarded over the interconnect without deleting the VPN.

Answer

Create a VPC firewall rule to allow traffic on the VLAN attachment

Answer

Add a firewall rule in the VPC allowing traffic from the on-premises IP ranges on the interconnect

Answer

Delete the Cloud VPN tunnel and gateway to force traffic over the interconnect

Question 4

A large enterprise has two on-premises data centers (DC1 and DC2) connected to Google Cloud via two separate VPN tunnels to the same VPC. Each tunnel terminates on a different Cloud VPN gateway (gateway1 in us-east1, gateway2 in us-west1). The on-premises routers advertise the same CIDR 172.16.0.0/12 from both DCs. Cloud Router is configured with BGP and uses default route priority. You notice that after a failover event where one tunnel goes down, traffic continues to flow, but there is a significant increase in latency for traffic coming from GCP to on-premises. You verify that both tunnels have re-established. What is the most likely cause of the increased latency?

Accepted Answer

The on-premises routers do not use AS path prepending to prefer the local DC's path for the prefix. When both on-premises routers advertise the same CIDR (172.16.0.0/12) to Google Cloud via BGP, Cloud Router selects the path with the shorter AS path length by default. Without AS path prepending on the backup DC's router, both routes have equal AS path length, causing Cloud Router to load-balance or pick a suboptimal path after failover. After the tunnel re-establishes, traffic from GCP may still be routed to the remote DC (e.g., DC2) instead of the local DC (DC1), resulting in higher latency due to cross-country or inter-DC transit.

Answer

The on-premises routers are using site-to-site VPN between themselves causing a routing loop

Answer

The Cloud VPN tunnels are using different preshared keys

Answer

Bidirectional Forwarding Detection (BFD) is not enabled on the Cloud VPN tunnels

Question 5

A company has a Cloud VPN tunnel with dynamic routing (BGP) connecting their on-premises network to a VPC in us-central1. They recently added a new subnet (10.2.0.0/16) to the VPC. The on-premises network still cannot reach resources in the new subnet. The Cloud Router BGP session is established and routes from on-prem are being received. What is the most likely cause?

Accepted Answer

The new subnet range is not included in the Cloud Router's advertised routes. When a new subnet is added to a VPC, the Cloud Router must be configured to advertise that subnet's CIDR range to the on-premises BGP peer. Even though the BGP session is established and routes from on-premises are received, the Cloud Router will not automatically advertise the new subnet unless its advertised route list is updated. Without the new subnet in the Cloud Router's advertised routes, the on-premises network has no path to reach 10.2.0.0/16, causing connectivity failure.

Answer

The Cloud Router does not support more than 10 custom dynamic routes

Answer

BGP session is not established

Answer

Firewall rules are blocking traffic

Question 6

A financial services firm needs to connect their on-premises data center to Google Cloud VPC with 50 Gbps of bandwidth and latency under 5 ms. They are in a metropolitan area with a Google Cloud region. They require an SLA of 99.99% and need to support VLAN attachments to multiple VPCs. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides direct, private connections between the on-premises data center and Google Cloud VPC, supporting up to 80 Gbps per interconnect (via 8 x 10 Gbps links) and offering a 99.99% SLA when configured with redundant links. It supports VLAN attachments (VLANs) to multiple VPCs, enabling segmentation across different environments, and meets the sub-5 ms latency requirement within a metropolitan area with a Google Cloud region.

Answer

Direct Peering

Answer

Cloud VPN with multiple tunnels and ECMP

Answer

Partner Interconnect

Question 7

An organization has two Cloud VPN tunnels from the same on-premises router to a Cloud Router in Google Cloud. Both tunnels are using BGP, and the on-premises router is sending the same routes over both tunnels. The Cloud Router is configured to use 'route propagation' from a VPC network. Which of the following is true regarding route priority?

Accepted Answer

Cloud Router will use both tunnels for load balancing (ECMP) if the routes are identical. When both BGP routes are identical in prefix, AS path, local preference, MED, and other attributes, Cloud Router uses ECMP (Equal-Cost Multi-Path) to load balance traffic across both Cloud VPN tunnels. Route propagation in the VPC network does not alter the BGP best-path selection; it simply injects the learned routes into the VPC routing table. Since the on-premises router advertises the same routes over both tunnels, Cloud Router treats them as equal-cost paths and distributes traffic across both tunnels.

Answer

The tunnel with the lower local preference value will be used

Answer

The tunnel with the higher BGP MED value will be preferred

Answer

Only the tunnel with the lowest IP address will be used

Question 8

A company has a VPC with subnets in us-east1 and us-west1. They have established a Cloud VPN tunnel to their on-premises network through a Cloud Router in us-east1. They want to ensure that traffic from on-premises to resources in us-west1 uses the VPN tunnel and not the public internet. What must be configured?

Accepted Answer

Add a route on the on-premises router for us-west1 subnets with next hop pointing to the VPN tunnel. The on-premises router must have a route for the us-west1 subnets with the VPN tunnel as the next hop. Without this, the on-premises router will use its default route (typically the public internet) to reach us-west1, bypassing the VPN tunnel. The Cloud Router in us-east1 advertises the us-west1 subnets via BGP over the VPN tunnel, but the on-premises router must be explicitly configured to forward traffic for those subnets into the tunnel.

Answer

Configure a custom dynamic route on the Cloud Router for us-west1 subnets

Answer

Create a separate VPN tunnel from on-premises to a Cloud Router in us-west1

Answer

Configure VPC firewall rules to allow traffic from on-premises to us-west1

Question 9

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address. When the BGP session state is stuck in 'CONNECT', it indicates that the router is actively trying to initiate a TCP connection to the peer but is not receiving a response. For BGP to establish a TCP session (port 179), the on-premises router must have a valid IP route to the Cloud Router's BGP peer IP address. Without this route, TCP SYN packets are dropped, preventing the session from transitioning to 'ESTABLISHED'.

Answer

Change the BGP ASN on the Cloud Router to a different number

Answer

Increase the BGP hold timer on the Cloud Router

Answer

Change the BGP keepalive interval to 10 seconds

Question 10

Your company has two on-premises data centers, DC1 and DC2, each connected to a separate Google Cloud VPC via Dedicated Interconnect. Both VPCs are connected via VPC Network Peering. A new application deployed in VPC1 needs to communicate with a database in DC2. The database IP range is 10.0.0.0/16. You have configured firewall rules to allow the traffic. However, the application cannot reach the database. You have verified that routes for 10.0.0.0/16 exist in VPC1's route table with next hop to VPC Peering, and in VPC2's route table with next hop to the interconnect attachment. The BGP sessions on both interconnects are up. What is the most likely reason for the connectivity failure?

Accepted Answer

VPC Network Peering does not support transitive routing through a peered VPC. VPC Network Peering does not support transitive routing. In this topology, VPC1 is peered with VPC2, but traffic from VPC1 to DC2 must pass through VPC2 and then over the interconnect. Since VPC1's route for 10.0.0.0/16 points to the VPC peering as next hop, VPC1 expects the traffic to be forwarded directly to VPC2. However, VPC2 cannot forward that traffic to DC2 because Google Cloud VPC peering does not allow a peered VPC to act as a transit hub; each VPC can only communicate directly with its peer, not with resources reachable through that peer. This is a fundamental limitation of VPC Network Peering, which is non-transitive.

Answer

The route for 10.0.0.0/16 in VPC1 is not imported correctly from VPC Peering

Answer

BGP session on the interconnect between VPC2 and DC2 is down

Answer

Firewall rules in VPC2 are blocking traffic

Question 11

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have already ordered a cross-connect from their co-location facility to a Google Point of Presence (PoP). What is the NEXT step to establish the connection?

Accepted Answer

Create a VLAN attachment in Google Cloud. After the physical cross-connect is in place, the next step is to create a VLAN attachment in the Cloud Console or via gcloud. The VLAN attachment is the logical construct that represents the connection between the on-premises router and the Cloud Router.

Answer

Create a Cloud Router and BGP session

Answer

Run a ping test to verify connectivity

Answer

Configure BGP on the on-premises router

Question 12

An organization is connecting their on-premises data center to Google Cloud via Partner Interconnect. The partner offers both Layer 2 and Layer 3 connectivity options. The organization wants to manage their own BGP sessions and IP addressing. Which connectivity option should they choose?

Accepted Answer

Layer 2 connectivity. With Layer 2, the service provider delivers a transparent VLAN, and the customer manages the BGP session with Google Cloud Router. Layer 3 would mean the partner manages the routing, which is not desired here.

Answer

Any Layer option because they can manage BGP regardless

Answer

Neither; they must use Dedicated Interconnect

Answer

Layer 3 connectivity

Question 13

A company has deployed an HA VPN gateway in Google Cloud to connect to their on-premises network. They have configured two tunnels with IKEv2 and BGP. One tunnel is established, but the second tunnel is not coming up. What could be a likely cause?

Accepted Answer

The pre-shared keys are mismatched between the two tunnels. Common issues include mismatched pre-shared keys or IKE versions. Since the first tunnel works, the configuration is mostly correct, but the second tunnel may have a different pre-shared key or PSK mismatch. Incorrect IKE version is less likely because both tunnels use the same gateway. BGP timers are usually consistent. Cloud VPN logs would help identify the root cause.

Answer

IKE version is set to IKEv1 on one side

Answer

The second tunnel's peer IP is unreachable

Answer

BGP timers are inconsistent

Question 14

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. Both connections are active and they want to use both simultaneously for load balancing traffic. They have configured two VLAN attachments each with a Cloud Router and BGP sessions. How should they configure BGP to achieve active-active load sharing?

Accepted Answer

Configure the on-premises router to enable ECMP for the BGP routes. Equal-cost multipath (ECMP) requires that the routes from both connections have the same next-hop attribute and are learned via different BGP sessions. By default, Cloud Router advertises the same routes with the same MED and AS path. To enable ECMP, the on-premises router must be configured to accept multiple equal-cost paths. The Cloud Router will automatically advertise routes with identical attributes when using separate VLAN attachments, and the on-premises router can then load balance.

Answer

Set different local preference values on the Google Cloud Router

Answer

Use AS path prepending on one connection to make it less preferred

Answer

Assign different MED values to each connection to influence preference

Question 15

An engineer needs to set up DNS resolution for on-premises resources from Google Cloud. They want to resolve a custom domain (e.g., corp.example.com) using on-premises DNS servers. Which Cloud DNS feature should they use?

Accepted Answer

DNS forwarding zone. DNS forwarding zones in Cloud DNS allow you to forward queries for a specific domain to a set of on-premises DNS server IPs. This is achieved by creating a forwarding zone with the target name servers pointing to the on-premises DNS servers.

Answer

Cloud DNS peering

Answer

Outbound DNS forwarding

Answer

Inbound DNS policy