PCNE Implementing Hybrid Interconnectivity Practice Test 13 — 15 Questions

Question 1

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The passive VLAN attachment does not have BGP session configured with Cloud Router.. For failover to work with active-passive, the passive connection must have its own VLAN attachment and Cloud Router BGP session with the same routes, but with a higher MED value to be less preferred. If the VLAN attachment is not created, there is no path.

Answer

The SLA requires two circuits in different metro areas for failover.

Answer

The on-premises router is not configured to use the passive connection.

Answer

The passive connection is in a different metro area, causing higher latency.

Question 2

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They want to prioritize traffic from on-premises to GCP over one VPN tunnel when multiple tunnels are available. Which BGP attribute should they configure on their on-premises router?

Accepted Answer

Local Preference (LP). Local Preference (LP) is a BGP attribute that influences outbound traffic from an AS. When configuring multiple VPN tunnels, setting a higher Local Preference on the preferred tunnel will cause the on-premises router to choose that tunnel for traffic destined to GCP. AS path prepending, on the other hand, is used to influence inbound traffic by making a route less preferred; it does not affect outbound path selection from the on-premises network.

Answer

MED (Multi-Exit Discriminator)

Answer

AS path prepending

Answer

Origin attribute

Question 3

A company needs to resolve DNS queries from their Google Cloud VPC for on-premises hostnames (e.g., internal.mycompany.com). They have a Cloud VPN tunnel between GCP and on-premises. Which approach should they use?

Accepted Answer

Create a DNS forwarding zone in Cloud DNS that points to the on-premises DNS server IPs via the Cloud Router.. Cloud DNS forwarding zones allow you to forward queries for a specific domain (e.g., internal.mycompany.com) to on-premises DNS servers via the VPN tunnel.

Answer

Configure an outbound DNS forwarding policy with Cloud Router to forward queries to on-premises DNS servers.

Answer

Create a Cloud DNS private zone and add A records for each on-premises host.

Answer

Set up a BIND server on a Compute Engine instance and configure it as a forwarder.

Question 4

A network engineer is configuring an HA VPN tunnel pair between an on-premises VPN device and Google Cloud. The engineer wants to use IKEv2 with pre-shared keys. After configuring both ends, the tunnels do not come up. The engineer sees 'IKE SA negotiation failed - no proposal chosen' in the logs. What is the most likely cause?

Accepted Answer

The encryption algorithm (e.g., AES256) or DH group (e.g., 14) does not match between the two ends.. This error typically indicates a mismatch in IKE proposal parameters such as encryption algorithm, integrity algorithm, DH group, or SA lifetime.

Answer

The on-premises device is behind NAT and the VPN gateway does not support NAT traversal.

Answer

The IKE version on the on-premises device is set to IKEv1 while Cloud VPN expects IKEv2.

Answer

The pre-shared keys on both ends are different.

Question 5

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The remaining circuit does not have sufficient bandwidth to handle the combined traffic load.. In active-active mode, both circuits are used simultaneously. When one fails, traffic is re-routed to the remaining one. If there is insufficient bandwidth on the remaining circuit, packet loss may occur due to congestion.

Answer

The VLAN attachments are not configured with the same Cloud Router.

Answer

The BGP timers are set too high, causing slow convergence.

Answer

The on-premises router is not configured with equal-cost multipath (ECMP).

Question 6

A network engineer wants to monitor the operational status of a Dedicated Interconnect link using Cloud Monitoring. Which metric should they use to check if the physical link is up or down?

Accepted Answer

interconnect/link/operational_status. The metric `interconnect/link/operational_status` directly indicates whether the physical link is up (1) or down (0).

Answer

interconnect/network/received_bytes_count

Answer

vpn/tunnel/status

Answer

interconnect/network/packets_dropped_percent

Question 7

A company is using Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer has created a VLAN attachment of type PARTNER_PROVIDER in Google Cloud. What must the service provider do to complete the connection?

Accepted Answer

Provide the engineer with a pairing key to attach the VLAN attachment to the interconnect.. For Partner Interconnect, the customer creates a VLAN attachment of type PARTNER (not PARTNER_PROVIDER) and gets a pairing key. The service provider uses this pairing key to connect their network to the customer's VLAN attachment. Therefore, the provider must provide the pairing key, not create a separate VLAN attachment. Option B correctly states this.

Answer

Create a VLAN attachment of type PARTNER on their end and associate it with the customer's VLAN attachment.

Answer

Assign a public IP address to the VLAN attachment.

Answer

Configure BGP routing with the customer's on-premises router.

Question 8

A network engineer is configuring a route-based VPN tunnel between an on-premises network and Google Cloud using Cloud VPN. Which two statements are true about route-based VPN compared to policy-based VPN? (Choose two.)

Accepted Answer

Route-based VPNs automatically route traffic based on the routing table entries.. Route-based VPNs use routing tables (like BGP) to determine which traffic is sent through the tunnel, and they support dynamic routing protocols like BGP.

Answer

Route-based VPNs are less flexible than policy-based VPNs for traffic selection.

Answer

Route-based VPNs require static routes to be configured manually.

Answer

Route-based VPNs require separate security policies for each traffic flow.

Question 9

A company has two Dedicated Interconnect connections in different metro areas to meet the 99.99% SLA. They want to ensure that traffic uses both connections in an active-active manner. Which three configurations are required? (Choose three.)

Accepted Answer

Configure BGP on both VLAN attachments with equal MED values.. For active-active, you need two VLAN attachments (one per connection), both attached to the same Cloud Router, and you must configure BGP on both attachments with the same route preferences (e.g., equal MED) to enable ECMP.

Answer

Create a single VLAN attachment shared across both connections.

Answer

Set the VLAN attachments to use static routing instead of BGP.

Question 10

A network engineer is troubleshooting a VPN tunnel that is up but not passing traffic. The Cloud Router shows that BGP sessions are established, but routes are not being exchanged. Which two should the engineer check? (Choose two.)

Accepted Answer

Ensure that the firewall rules in the VPC allow traffic from the on-premises IP ranges.. Common issues: incorrect firewall rules blocking the traffic, or the route advertisements are not configured correctly (e.g., not advertising the correct prefixes).

Answer

Verify that the Cloud Router is using the correct ASN.

Answer

Check that the Cloud VPN gateway has the correct pre-shared key configured.

Answer

Confirm that the VLAN attachment is of type PARTNER_PROVIDER.

Question 11

A company wants to establish a dedicated physical connection between their on-premises network and Google Cloud. They need a 10 Gbps connection and are willing to manage the circuit and colocation facility themselves. Which Google Cloud service should they use?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection between the on-premises network and Google's network via a colocation facility and Google Partner PoP. It is managed by the customer for circuit ordering and colocation.

Answer

Partner Interconnect

Answer

Cloud CDN

Answer

Cloud VPN

Question 12

An engineer has set up a Dedicated Interconnect with a VLAN attachment and a Cloud Router BGP session. They can ping the on-premises gateway IP but cannot reach an on-premises subnet 10.0.0.0/24 from a GCE instance. The on-premises router is advertising the subnet via BGP. What is the most likely cause?

Accepted Answer

The GCE instance does not have a route to the on-premises subnet. The GCE instance can ping the on-premises gateway IP because the Cloud Router has a BGP session and the gateway IP is directly reachable via the VLAN attachment. However, to reach the on-premises subnet 10.0.0.0/24, the GCE VPC needs a route for that subnet pointing to the Cloud Router as the next hop. Without an automatically propagated or manually configured route in the VPC, traffic from the GCE instance to 10.0.0.0/24 will be dropped, even though the on-premises router is advertising the subnet via BGP.

Answer

The VLAN attachment is in the wrong region

Answer

The on-premises firewall is blocking ICMP

Answer

The on-premises router is not using the correct BGP AS number

Question 13

An enterprise requires a hybrid connectivity solution that meets a 99.99% SLA. They plan to use Dedicated Interconnect. Which configuration satisfies the SLA requirement?

Accepted Answer

Two Dedicated Interconnect connections in different metro areas with active-active configuration. Google's 99.99% SLA for Dedicated Interconnect requires two connections, each from a different metro area, configured for active-active or active-passive.

Answer

Two Partner Interconnect connections from different providers in the same metro area

Answer

Two Dedicated Interconnect connections in the same metro area with active-passive configuration

Answer

Single Dedicated Interconnect connection with two VLAN attachments

Question 14

A company uses High Availability VPN (HA VPN) with two tunnels and BGP to connect to an on-premises network. They notice traffic only flows through one tunnel. They want to ensure both tunnels are used simultaneously. What should they do?

Accepted Answer

Enable equal-cost multipath (ECMP) on the Cloud Router. To use both tunnels simultaneously, ECMP must be enabled in the VPC. By default, HA VPN with BGP uses active-passive if the on-premises router uses a lower local preference for one path. ECMP can be enabled on the Cloud Router.

Answer

Increase the MED value on the active tunnel to make it less preferred

Answer

Configure both tunnels with the same BGP AS number on the on-premises side

Answer

Configure static routes with equal cost for both tunnels

Question 15

A company wants to resolve on-premises DNS names from Google Cloud VMs. They have a Cloud DNS private zone for their domain and on-premises DNS servers at IP 10.1.1.1 and 10.1.1.2. Which Cloud DNS feature should they use?

Accepted Answer

Outbound DNS forwarding using an outbound forwarding zone. DNS forwarding zones allow Cloud DNS to forward queries for a specific domain to on-premises DNS servers.

Answer

Inbound DNS policy

Answer

Peering zones

Answer

Managed reverse lookup zones