PCNE Implementing Hybrid Interconnectivity Practice Test 11 — 15 Questions

Question 1

A company has a HA VPN gateway in Google Cloud with two tunnels to their on-premises router. They want to ensure that if one tunnel fails, all traffic automatically fails over to the other tunnel. What configuration is necessary on the on-premises router?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a higher local preference on the primary tunnel. For failover, the on-premises router should prefer one tunnel over the other using BGP attributes like local preference or AS path prepending. Typically, one tunnel is primary and the other is backup. Both tunnels should be established with BGP sessions, and the on-premises router should learn the same routes from both, but with different local preference values to determine the primary path.

Answer

Use AS path prepending on the primary tunnel to make it preferred

Answer

Configure the same MED value on both tunnels

Answer

Configure ECMP to load balance across both tunnels

Question 2

A network engineer is setting up a Dedicated Interconnect with a 10 Gbps circuit. They need to achieve 99.99% availability SLA. Which of the following configurations meets the SLA requirements?

Accepted Answer

Two 10 Gbps circuits in different metro areas. Google Cloud's 99.99% SLA for Dedicated Interconnect requires two connections from two different metro areas (redundant locations). Each connection must be 10 Gbps or more. Active-active or active-passive is acceptable, but the key is two circuits in different metros.

Answer

One 10 Gbps circuit and one VPN as backup

Answer

Single 10 Gbps circuit in one metro area

Answer

Two 10 Gbps circuits in the same metro area

Question 3

A company is using Partner Interconnect with a service provider that requires the use of VLAN attachments. Which type of VLAN attachment should they create in Google Cloud to use the partner's connection?

Accepted Answer

PARTNER. For Partner Interconnect, you create a VLAN attachment of type PARTNER. This attachment represents the logical connection to the partner's network. The partner can also use PARTNER_PROVIDER type if they manage the attachment, but from the customer side, it's PARTNER.

Answer

DEDICATED

Answer

PARTNER_PROVIDER

Answer

CUSTOMER

Question 4

A company has set up a route-based HA VPN tunnel between Google Cloud and their on-premises network. They are experiencing packet loss and need to troubleshoot. Which logs or metrics would provide the MOST relevant information to diagnose the issue?

Accepted Answer

Cloud VPN gateway logs (syslog). Cloud VPN gateway logs provide detailed information about tunnel establishment, IKE negotiations, and BGP messages. They can help identify packet loss causes like MTU issues, encryption mismatches, or routing problems. Cloud Monitoring metrics for VPN tunnels show traffic volume and errors, but logs provide more granular detail.

Answer

Cloud Monitoring metric: interconnect/network/received_bytes_count

Answer

Cloud Load Balancing logs

Answer

VPC flow logs

Question 5

An organization has a Dedicated Interconnect with one VLAN attachment. They want to add a second VLAN attachment on the same interconnect circuit for additional capacity. What is the correct approach?

Accepted Answer

Create a second VLAN attachment with a different VLAN ID. A single Dedicated Interconnect circuit can have multiple VLAN attachments (up to 8 for 10 Gbps, up to 64 for 100 Gbps). You simply create another VLAN attachment on the same interconnect, using a different VLAN ID and a different Cloud Router if desired.

Answer

Order a second physical cross-connect

Answer

Upgrade the existing VLAN attachment to increase bandwidth

Answer

Create a new Cloud Router and associate it with the existing VLAN attachment

Question 6

A company has deployed a Cloud VPN tunnel using route-based VPN (using IKEv2) and has configured BGP on the tunnel. The tunnel is up, but the BGP session is not establishing. What is a likely cause?

Accepted Answer

The BGP IP addresses are not reachable over the tunnel. For route-based VPN tunnels, BGP peering requires that the Cloud VPN gateway and the on-premises router can reach each other's BGP IP addresses. The BGP IPs are typically link-local addresses derived from the tunnel's interface. If the BGP session is not establishing, common issues include incorrect BGP IP configuration, firewall rules blocking BGP (port 179), or the tunnel not passing traffic correctly.

Answer

IKE version mismatch

Answer

The pre-shared key is incorrect

Answer

The Cloud Router is not configured

Question 7

A company wants to use AS path prepending to influence traffic from Google Cloud to their on-premises network to prefer one Dedicated Interconnect connection over another. How should they configure AS path prepending?

Accepted Answer

Configure AS path prepending on the on-premises router for the routes advertised to Google Cloud. AS path prepending is done on the on-premises router by adding the on-premises AS number multiple times in the BGP updates sent to Google Cloud. Google Cloud Router will then prefer the path with the shorter AS path length (fewer prepends). To make one connection less preferred, the on-premises router should prepend AS numbers on the BGP updates sent over that connection.

Answer

Configure AS path prepending on the Cloud Router for the routes advertised to on-premises

Answer

Configure AS path prepending on both sides equally

Answer

Use MED instead of AS path prepending

Question 8

A company needs to connect their on-premises network to Google Cloud with high availability and load balancing across multiple tunnels. They plan to use HA VPN. Which TWO of the following are required to achieve active-active load balancing across multiple tunnels?

Accepted Answer

Configure the on-premises router to enable ECMP. For active-active load balancing, Cloud Router BGP must advertise the same routes with identical attributes, and the on-premises router must support ECMP. Often, two tunnels are configured as a pair. The on-premises router must be configured to accept equal-cost routes.

Answer

Use AS path prepending on one tunnel

Answer

Use different MED values for each tunnel

Answer

Configure static routes instead of BGP

Question 9

An organization is setting up a Dedicated Interconnect and wants to monitor the health and performance of the connection using Cloud Monitoring. Which THREE metrics are available for Dedicated Interconnect?

Accepted Answer

interconnect/network/received_bytes_count. Cloud Monitoring provides several metrics for Dedicated Interconnect, including traffic volume (received_bytes_count), link operational status, and packet loss. VLAN attachment metrics are also available, but the question asks for interconnect metrics.

Answer

interconnect/network/traffic_drops

Answer

interconnect/vpn/tunnel_status

Question 10

A company is deploying Cloud DNS to enable on-premises resources to resolve Google Cloud private zone names. Which TWO resources are required for this setup?

Accepted Answer

Inbound DNS policy. To allow on-premises DNS queries to reach Google Cloud private zones, you need an inbound DNS policy that creates a forwarding IP address in a VPC, and you need to configure on-premises DNS servers to forward those queries to that IP. A forwarding zone is used for the opposite direction (GCP to on-premises).

Answer

VPC peering

Answer

Cloud Router

Answer

Outbound DNS forwarding zone

Question 11

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have ordered a circuit from a telecom provider and need to complete the setup. Which of the following steps is required during the provisioning process?

Accepted Answer

Create a VLAN attachment in the Google Cloud Console.. When provisioning a Dedicated Interconnect, after the telecom provider has delivered the circuit to the meet-me room, you must create a VLAN attachment (formerly called a VLAN attachment or interconnect attachment) in the Google Cloud Console. This attachment defines the VLAN and the Cloud Router that will establish BGP peering with your on-premises router, making it the essential step to complete the Layer 2 and Layer 3 connectivity.

Answer

Set up a VPN tunnel for redundancy.

Answer

Configure on-premises DNS forwarding to Cloud DNS.

Answer

Configure the Cloud Router BGP session before ordering the circuit.

Question 12

A network engineer needs to test connectivity after setting up a Dedicated Interconnect VLAN attachment and BGP session. Which tool should they use to verify that Google Cloud can reach an on-premises IP address?

Accepted Answer

ping and traceroute from a Google Cloud VM to the on-premises IP.. The standard tools to test connectivity are ping (ICMP echo) and traceroute (path discovery). They are used after BGP is established to verify end-to-end reachability.

Answer

gcloud compute interconnect list command.

Answer

Cloud Monitoring dashboard for interconnect metrics.

Answer

tcpdump on the on-premises router.

Question 13

A company uses Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer needs to establish BGP peering between the on-premises router and Cloud Router. What must be created in Google Cloud to enable this?

Accepted Answer

A VLAN attachment of type PARTNER_PROVIDER.. With Layer 2 Partner Interconnect, the service provider extends a VLAN to Google. You create a VLAN attachment of type PARTNER_PROVIDER, which allows you to configure the Cloud Router and BGP session.

Answer

An HA VPN gateway.

Answer

A Dedicated Interconnect attachment.

Answer

A VLAN attachment of type PARTNER.

Question 14

A company is setting up HA VPN between GCP and an on-premises network. They need to configure two VPN tunnels for high availability. Which of the following is required for the HA VPN gateway?

Accepted Answer

Two external IP addresses, one for each interface.. An HA VPN gateway has two interfaces, each with its own external IP address. This allows two tunnels to be established for redundancy.

Answer

A single external IP address shared by both interfaces.

Answer

A Cloud Router with BGP enabled on both tunnels.

Answer

A dedicated interconnect circuit.

Question 15

A network engineer is troubleshooting a failing HA VPN tunnel. They need to view VPN gateway logs to identify the issue. Which Google Cloud service should they use to access the logs?

Accepted Answer

Cloud Logging. Cloud Logging captures logs from Cloud VPN gateways, including tunnel events, IKE negotiations, and error messages.

Answer

Cloud Audit Logs

Answer

Cloud Debugger

Answer

Cloud Monitoring