PCNE Implementing Hybrid Interconnectivity Practice Test 12 — 15 Questions

Question 1

A company wants to use HA VPN with route-based VPN. Which VPN configuration option must be enabled?

Accepted Answer

Route-based VPN by selecting Dynamic Routing (BGP) or using static routes.. Route-based VPN uses routing (BGP or static routes) to determine which traffic goes through the tunnel, as opposed to policy-based which uses security policies.

Answer

IKEv1 with pre-shared keys.

Answer

Using certificates instead of pre-shared keys.

Answer

Policy-based VPN with multiple policies for each subnet.

Question 2

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. They want to achieve a 99.99% SLA. What is the minimum requirement?

Accepted Answer

Two Dedicated Interconnect connections from different metro areas, configured for redundancy.. To meet the 99.99% SLA, you need at least two connections that are diverse (different metro areas) and configured in active-active or active-passive mode. This ensures redundancy if one fails.

Answer

One Dedicated Interconnect connection with two VLAN attachments.

Answer

One Dedicated Interconnect and one Partner Interconnect.

Answer

Two Dedicated Interconnect connections in the same metro area.

Question 3

An engineer needs to monitor the operational status of a Dedicated Interconnect link. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The metric interconnect/link/operational_status reflects if the link is up or down, exactly what is needed to monitor the link status.

Answer

interconnect/attachment/operational_status

Answer

interconnect/network/sent_bytes_count

Answer

interconnect/network/received_bytes_count

Question 4

A company wants to use BGP AS path prepending to influence traffic from Google Cloud to their on-premises network. They have two Dedicated Interconnect connections. Where should they configure the AS path prepending?

Accepted Answer

On the on-premises router by adding extra AS numbers to the AS path.. AS path prepending is configured on the on-premises router when advertising routes to Google Cloud. The router adds extra AS numbers to make a path less preferred.

Answer

On the Cloud Router BGP session.

Answer

In the VLAN attachment configuration.

Answer

In the Cloud Router as a route policy with set as-path prepend.

Question 5

A company needs to resolve on-premises DNS names from Google Cloud VMs. They want to forward DNS queries for a specific domain (example.corp) to an on-premises DNS server. Which Cloud DNS feature should they use?

Accepted Answer

Outbound DNS forwarding (conditional forwarding). Outbound DNS forwarding with conditional forwarding allows Cloud DNS to forward queries for a specific domain (example.corp) to an on-premises DNS server. This is the correct feature because it selectively routes DNS traffic based on the domain name, enabling resolution of private on-premises names from Google Cloud VMs without exposing the entire VPC network.

Answer

Private DNS zones

Answer

DNS peering

Answer

Inbound DNS policy

Question 6

A company wants to allow on-premises DNS servers to resolve Google Cloud private VM names. They need to configure a Google-managed forwarding server IP. Which Cloud DNS feature should they use?

Accepted Answer

Inbound DNS policy. Inbound DNS policy creates a forwarding zone and provides a Google-managed inbound server IP that on-premises servers can use to resolve GCP private DNS names.

Answer

Outbound DNS forwarding

Answer

Cloud Router with BGP

Answer

Private DNS zone with peering

Question 7

A company has two HA VPN tunnels between GCP and on-premises. They want to use both tunnels simultaneously for load balancing traffic. Which BGP feature should they configure on the Cloud Router to achieve equal-cost multipath (ECMP)?

Accepted Answer

Advertise identical routes with equal BGP metrics (AS path length, MED, etc.) from both tunnels.. ECMP is achieved by having multiple BGP paths with equal MED and AS path length. The Cloud Router automatically load balances if routes have equal metrics.

Answer

Use AS path prepending on one tunnel.

Answer

Set different MED values on each tunnel to prefer one.

Answer

Enable policy-based VPN instead of route-based.

Question 8

A company is planning a hybrid cloud connectivity strategy with Google Cloud. They need high bandwidth (10 Gbps) and low latency. They also want to avoid internet transit. Which TWO connectivity options meet these requirements? (Choose 2.)

Accepted Answer

Partner Interconnect. Dedicated Interconnect provides direct, high-bandwidth (up to 80 Gbps per circuit) physical connection with low latency, not over the internet. Partner Interconnect also provides high bandwidth via a service provider, often at 1 Gbps or 10 Gbps, and is not internet-based. VPN uses the internet and does not guarantee bandwidth or low latency.

Answer

CDN Interconnect

Answer

Direct Peering

Answer

Cloud VPN

Question 9

A network engineer is configuring HA VPN between GCP and an on-premises network. They need to ensure that the VPN tunnels are established and BGP sessions are up. Which THREE steps are required? (Choose 3.)

Accepted Answer

Create an HA VPN gateway with two interfaces and two external IPs.. To establish HA VPN, you must create the VPN gateway with two interfaces and two external IPs, configure a Cloud Router to handle BGP, and create two VPN tunnels (one for each interface) with IKEv2 configuration. Pre-shared keys or certificates are part of tunnel configuration, but the key step is creating the tunnels.

Answer

Configure firewall rules to allow IKE traffic.

Answer

Set up Cloud NAT for internet access.

Question 10

A company wants to use BGP traffic engineering to control how traffic flows between GCP and their on-premises network over two Dedicated Interconnect connections. Which TWO BGP attributes can they use on Cloud Router? (Choose 2.)

Accepted Answer

BGP communities. On Cloud Router, you can set MED (metric) to influence inbound traffic and use AS path prepending (though not directly on Cloud Router; you can influence outbound via MED). Actually, Cloud Router supports setting MED on advertised routes. BGP communities can also be used for tagging routes. Weight is a Cisco-specific attribute, not available on Cloud Router.

Answer

Weight

Answer

Local preference

Answer

AS path prepending

Question 11

An organization wants to connect their on-premises network to Google Cloud using a Dedicated Interconnect. They have ordered a circuit from a network service provider and need to determine the correct co-location facility to connect to. Which factor is most critical when selecting a co-location facility?

Accepted Answer

The facility must be a Google Cloud partner facility with access to a Google PoP in the same metro as the on-premises data center.. The co-location facility must be a Google Cloud partner facility that provides access to a Google Point of Presence (PoP) in the same metro area as the organization's on-premises data center to minimize latency and meet SLA requirements.

Answer

The facility must offer Layer 2 connectivity to the Google Cloud VPC.

Answer

The facility must support 100 Gbps ports to maximize throughput.

Answer

The facility must be in a different continent to ensure geographic redundancy.

Question 12

A network engineer is setting up a Dedicated Interconnect between an on-premises network and Google Cloud. After the circuit is ordered and the physical connection is established at the co-location facility, what is the first step to configure the interconnect inside GCP?

Accepted Answer

Create a VLAN attachment to associate with the interconnect.. After the physical connection is ready, you must create a VLAN attachment in Google Cloud to define the connection between your VPC and the interconnect.

Answer

Configure a VPN tunnel for backup connectivity.

Answer

Enable Cloud NAT for outbound traffic.

Answer

Create a Cloud Router with BGP sessions.

Question 13

A company is using Partner Interconnect to connect their on-premises network to Google Cloud. They need to choose between Layer 2 and Layer 3 connectivity options offered by the service provider. Which statement correctly describes the difference between Layer 2 and Layer 3 connectivity in Partner Interconnect?

Accepted Answer

Layer 3 connectivity requires the customer to have a BGP session with the partner's router, while Layer 2 allows direct BGP with Google Cloud.. With Layer 2, the partner provides a transparent VLAN; with Layer 3, the partner handles the IP routing, requiring a BGP session from the customer's on-prem router to the partner's router.

Answer

Layer 2 connectivity requires the customer to configure BGP with Google Cloud, while Layer 3 does not require any BGP on the customer side.

Answer

Layer 2 connectivity is only available for Dedicated Interconnect, not Partner Interconnect.

Answer

Both Layer 2 and Layer 3 require the customer to manage VLAN attachments inside GCP.

Question 14

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

Accepted Answer

Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.. HA VPN requires two tunnels (one per interface) to form a pair. Each tunnel requires a separate BGP session to provide redundancy.

Answer

Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.

Answer

Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.

Answer

Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.

Question 15

A network engineer is troubleshooting a Cloud VPN gateway that is not establishing a VPN tunnel with an on-premises device. The engineer checks the Cloud VPN gateway logs and sees the error 'IKE SA negotiation failed due to mismatched authentication method'. What is the most likely cause?

Accepted Answer

The authentication method is set to 'pre-shared key' on one side and 'certificate' on the other.. The error indicates a mismatch between the authentication methods configured on both ends, such as pre-shared key vs certificate, or different authentication types.

Answer

The pre-shared keys on both ends do not match.

Answer

The VPN gateway is using the wrong external IP address.

Answer

The IKE version configured on the on-premises device is IKEv1 while Cloud VPN only supports IKEv2.