PCNE Implementing Hybrid Interconnectivity Practice Test 14 — 15 Questions

Question 1

A company is using Partner Interconnect with a service provider that offers Layer 3 connectivity. The service provider manages the BGP sessions. The engineer needs to create a VLAN attachment on the Google side. Which attachment type should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PARTNER_PROVIDER. For Partner Interconnect, when the service provider manages Layer 3 (BGP), the VLAN attachment type must be PARTNER_PROVIDER. The PARTNER type is for Layer 2 connectivity where the customer manages BGP.

Answer

PARTNER

Answer

MANAGED

Answer

DEDICATED

Question 2

An engineer configures an HA VPN with two tunnels to an on-premises network using IKEv2 and pre-shared keys. After configuration, the tunnels show as established, but no traffic flows. The Cloud Router BGP sessions are not established. The on-premises firewall logs show IKE packets are being sent but no response. What is the most likely cause?

Accepted Answer

The pre-shared keys do not match. B is correct because the on-premises firewall logs show IKE packets being sent but no response, which indicates that the IKEv2 pre-shared key mismatch causes the IKE authentication phase to fail. Even though the tunnel status shows as established (likely due to a stale or misconfigured status check), the BGP sessions cannot form because the IKE security association (SA) is not fully authenticated, preventing the IPsec SA from being created and thus blocking all traffic, including BGP packets.

Answer

The Cloud Router BGP AS number is duplicated

Answer

The on-premises firewall is blocking UDP port 500

Answer

The VPN tunnel is configured as policy-based instead of route-based

Question 3

An organization has two Dedicated Interconnect connections in an active-passive configuration. They want to make the passive connection active for maintenance. What should they do to fail over traffic?

Accepted Answer

Configure as-path prepending on the active Cloud Router BGP session to make it less preferred. To fail over traffic, the engineer can use as-path prepending on the active connection to make it less preferred, or adjust MED, or use local preference on the on-premises side. The question implies a GCP-side action: using as-path prepending via Cloud Router BGP configuration.

Answer

Shut down the Cloud Router on the active connection

Answer

Set the MED metric to 0 on the active connection

Answer

Delete the VLAN attachment on the active connection

Question 4

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The metric 'interconnect/link/operational_status' provides the operational status of each interconnect link (e.g., operational, degraded).

Answer

interconnect/vlan_attachment/outbound_bytes

Answer

interconnect/network/packet_drop_count

Answer

interconnect/network/received_bytes_count

Question 5

An engineer is configuring a Cloud Router for HA VPN. They need to enable BGP on the VPN tunnels. Which BGP configuration is required for the Cloud Router to advertise the VPC subnets to the on-premises network?

Accepted Answer

Create a custom route advertisement for each subnet. Cloud Router uses Border Gateway Protocol (BGP) to dynamically exchange routes with the on-premises network over HA VPN tunnels. By default, Cloud Router advertises only the VPC subnet ranges that are directly connected to the VPC network. To ensure all VPC subnets are advertised, you must create custom route advertisements for each subnet that needs to be reachable from on-premises. This is done by configuring the Cloud Router with a custom advertisement mode and specifying the subnet CIDR ranges as custom advertised IP ranges.

Answer

Set up a VPC peering connection

Answer

Use static routes on the VPN tunnel

Answer

Configure the VPN gateway to advertise the subnets

Question 6

A company has a Partner Interconnect connection (Layer 2) with a service provider. They need to configure BGP sessions on their on-premises router and Google Cloud Router. The engineer creates a VLAN attachment of type PARTNER. However, the BGP session does not come up. What is the most likely reason?

Accepted Answer

The Cloud Router BGP IP address is not in the same subnet as the VLAN attachment. In Layer 2 Partner Interconnect, the customer must configure BGP sessions. The VLAN attachment type PARTNER requires the customer to manage BGP. Common issues include incorrect VLAN ID or IP addresses.

Answer

The VLAN attachment type should be PARTNER_PROVIDER

Answer

The IAM permissions for the Cloud Router are missing

Answer

The on-premises router is using a different BGP AS number than configured

Question 7

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

Accepted Answer

Inbound DNS policy. Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Answer

DNS peering

Answer

Outbound DNS forwarding zone

Answer

Private zone with DNS forwarding

Question 8

A company is designing a highly available hybrid network using HA VPN. They need to ensure that if one VPN tunnel fails, traffic automatically fails over to the other tunnel. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable BGP on both tunnels. HA VPN requires two tunnels from two interfaces, each with its own external IP, and BGP sessions on both tunnels. The on-premises side must also have two separate peer IPs.

Answer

Configure static routes for failover

Answer

Configure both tunnels with the same peer IP address on the on-premises side

Answer

Use the same pre-shared key for both tunnels

Question 9

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Accepted Answer

Mismatched BGP hold timer values. BGP session flapping can be caused by mismatched parameters, MTU issues, or authentication problems.

Answer

Incorrect VLAN ID on the VLAN attachment

Answer

Duplicate AS number on the on-premises router

Question 10

An organization is considering using Partner Interconnect to connect to Google Cloud. They want the service provider to manage the BGP sessions. Which TWO configurations must they choose? (Choose TWO.)

Accepted Answer

Create VLAN attachment of type PARTNER_PROVIDER. For Layer 3 connectivity where the provider manages BGP, the VLAN attachment type must be PARTNER_PROVIDER, and the provider handles BGP.

Answer

Select Layer 2 connectivity option with the provider

Answer

Create VLAN attachment of type PARTNER

Answer

Configure BGP sessions on the Cloud Router

Question 11

A company is deploying a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They require 99.99% availability for the interconnect. Which two actions must they take to meet this SLA?

Accepted Answer

Order two 10 Gbps circuits in different metro areas. To achieve 99.99% availability for Dedicated Interconnect, you need two connections with at least 10 Gbps each, placed in different metropolitan areas (different metro zones). This provides redundancy even if a whole metro area fails.

Answer

Order four 10 Gbps circuits in the same metro area

Answer

Order a single 10 Gbps circuit

Answer

Order two 10 Gbps circuits in the same metro area

Question 12

A network engineer is setting up a HA VPN between GCP and an on-premises network. They want to use route-based VPN with dynamic routing. Which two resources must be created together to form a functional HA VPN tunnel?

Accepted Answer

Two VPN tunnels, each with a BGP session on the same Cloud Router. An HA VPN gateway has two interfaces, each with its own external IP. For each interface, you create a VPN tunnel and attach it to a Cloud Router with a BGP session. The tunnel and BGP session are paired for each interface.

Answer

One VPN tunnel with two BGP sessions

Answer

Two VPN tunnels without BGP sessions

Answer

Two VPN gateways, each with one tunnel and one BGP session

Question 13

Your company has a Partner Interconnect connection via a service provider that offers Layer 3 connectivity. The provider assigns an IP address on the VLAN attachment. Which VLAN attachment type should you use when creating the attachment in Google Cloud?

Accepted Answer

PARTNER. When a service provider offers Layer 3 connectivity and assigns an IP address on the VLAN attachment, you must use the PARTNER attachment type. This type is specifically designed for Partner Interconnect with Layer 3 (routed) connections, where the provider manages the IP addressing and routing. PARTNER_PROVIDER is used for Layer 2 attachments where you assign your own IP addresses.

Answer

PARTNER_PROVIDER

Answer

VPN

Answer

DEDICATED

Question 14

You are troubleshooting a failing HA VPN tunnel between GCP and on-premises. The tunnel status shows 'Tunnel is down' in Cloud Console. Which TWO steps should you take to diagnose the issue? (Choose two.)

Accepted Answer

Check the on-premises firewall rules to ensure UDP ports 500 and 4500 are allowed. Checking Cloud VPN gateway logs for IKE errors helps identify authentication or configuration mismatch. Verifying that the on-premises firewall allows UDP 500 and 4500 for IPsec is necessary because many failures are due to firewall blocking.

Answer

Confirm that the GCP VPC has a firewall rule allowing inbound IPsec traffic

Answer

Verify that the Cloud Router BGP session is established

Answer

Ensure that the on-premises VPN gateway has a static route to the GCP VPC

Question 15

A company has two Dedicated Interconnect connections from different metro areas to their GCP VPC. They want to use both connections actively (active-active load balancing) without manual intervention. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Advertise the same on-premises prefix with the same MED on both BGP sessions. To use active-active, you must configure ECMP on the Cloud Router to load balance across both BGP sessions, and advertise the same prefixes with equal priority (same MED) from both on-premises routers.

Answer

Use AS path prepending on one of the BGP sessions

Answer

Create two separate Cloud Routers

Answer

Set different MED values on each BGP session