PCNE Implementing Hybrid Interconnectivity Practice Test 15 — 15 Questions

Question 1

An organization is connecting their on-premises data center to Google Cloud via Partner Interconnect. The partner offers both Layer 2 and Layer 3 connectivity options. The organization wants to manage their own BGP sessions and IP addressing. Which connectivity option should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Layer 2 connectivity. With Layer 2, the service provider delivers a transparent VLAN, and the customer manages the BGP session with Google Cloud Router. Layer 3 would mean the partner manages the routing, which is not desired here.

Answer

Any Layer option because they can manage BGP regardless

Answer

Neither; they must use Dedicated Interconnect

Answer

Layer 3 connectivity

Question 2

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. Both connections are active and they want to use both simultaneously for load balancing traffic. They have configured two VLAN attachments each with a Cloud Router and BGP sessions. How should they configure BGP to achieve active-active load sharing?

Accepted Answer

Configure the on-premises router to enable ECMP for the BGP routes. To use both Dedicated Interconnect connections simultaneously for load balancing, the on-premises router must enable Equal-Cost Multi-Path (ECMP) so BGP routes with equal attributes are installed and traffic is distributed across both paths. Google Cloud's side already advertises and accepts both paths; the on-prem router is what decides whether to load-share.

Answer

Set different local preference values on the Google Cloud Router

Answer

Use AS path prepending on one connection to make it less preferred

Answer

Assign different MED values to each connection to influence preference

Question 3

A network engineer is setting up a Dedicated Interconnect with a 10 Gbps circuit. They need to achieve 99.99% availability SLA. Which of the following configurations meets the SLA requirements?

Accepted Answer

Two 10 Gbps circuits in different metro areas. Google Cloud's 99.99% SLA for Dedicated Interconnect requires two or more connections in different metro areas, so this configuration is the only one that meets the requirement. Metro diversity ensures that a single metro-level failure cannot take down both circuits, which is the condition for the higher SLA tier.

Answer

One 10 Gbps circuit and one VPN as backup

Answer

Single 10 Gbps circuit in one metro area

Answer

Two 10 Gbps circuits in the same metro area

Question 4

A company is using Partner Interconnect with a service provider that requires the use of VLAN attachments. Which type of VLAN attachment should they create in Google Cloud to use the partner's connection?

Accepted Answer

PARTNER. For Partner Interconnect, you create a VLAN attachment of type PARTNER. This attachment represents the logical connection to the partner's network. The partner can also use PARTNER_PROVIDER type if they manage the attachment, but from the customer side, it's PARTNER.

Answer

DEDICATED

Answer

PARTNER_PROVIDER

Answer

CUSTOMER

Question 5

An organization has a Dedicated Interconnect with one VLAN attachment. They want to add a second VLAN attachment on the same interconnect circuit for additional capacity. What is the correct approach?

Accepted Answer

Create a second VLAN attachment with a different VLAN ID. A single Dedicated Interconnect circuit supports multiple VLAN attachments, each identified by a unique VLAN ID (802.1Q tag). To add capacity, you create a second VLAN attachment on the same circuit with a different VLAN ID, then associate it with a Cloud Router for BGP peering. No new physical cross-connect is required.

Answer

Order a second physical cross-connect

Answer

Upgrade the existing VLAN attachment to increase bandwidth

Answer

Create a new Cloud Router and associate it with the existing VLAN attachment

Question 6

A company has deployed a Cloud VPN tunnel using route-based VPN (using IKEv2) and has configured BGP on the tunnel. The tunnel is up, but the BGP session is not establishing. What is a likely cause?

Accepted Answer

The BGP IP addresses are not reachable over the tunnel. For a route-based Cloud VPN tunnel with BGP, the BGP session runs over the tunnel's internal IP addresses, so if those addresses are not reachable (e.g., wrong link-local or internal IP configuration, or missing firewall rules), the BGP session cannot establish even though IKE is up. This is the most likely cause when the tunnel is up but BGP is down.

Answer

IKE version mismatch

Answer

The pre-shared key is incorrect

Answer

The Cloud Router is not configured

Question 7

A company needs to connect their on-premises network to Google Cloud with high availability and load balancing across multiple tunnels. They plan to use HA VPN. Which TWO of the following are required to achieve active-active load balancing across multiple tunnels?

Accepted Answer

Configure the on-premises router to enable ECMP. For active-active load balancing, Cloud Router BGP must advertise the same routes with identical attributes, and the on-premises router must support ECMP. Often, two tunnels are configured as a pair. The on-premises router must be configured to accept equal-cost routes.

Answer

Use AS path prepending on one tunnel

Answer

Use different MED values for each tunnel

Answer

Configure static routes instead of BGP

Question 8

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have ordered a circuit from a telecom provider and need to complete the setup. Which of the following steps is required during the provisioning process?

Accepted Answer

Create a VLAN attachment in the Google Cloud Console.. When provisioning a Dedicated Interconnect, after the telecom provider has delivered the circuit to the meet-me room, you must create a VLAN attachment (formerly called a VLAN attachment or interconnect attachment) in the Google Cloud Console. This attachment defines the VLAN and the Cloud Router that will establish BGP peering with your on-premises router, making it the essential step to complete the Layer 2 and Layer 3 connectivity.

Answer

Set up a VPN tunnel for redundancy.

Answer

Configure on-premises DNS forwarding to Cloud DNS.

Answer

Configure the Cloud Router BGP session before ordering the circuit.

Question 9

A network engineer needs to test connectivity after setting up a Dedicated Interconnect VLAN attachment and BGP session. Which tool should they use to verify that Google Cloud can reach an on-premises IP address?

Accepted Answer

ping and traceroute from a Google Cloud VM to the on-premises IP.. After configuring a Dedicated Interconnect VLAN attachment and BGP session, the most direct way to verify connectivity from Google Cloud to an on-premises IP is to use ping and traceroute from a Google Cloud VM. These tools test actual data-plane reachability and path, confirming that routes are exchanged and traffic flows.

Answer

gcloud compute interconnect list command.

Answer

Cloud Monitoring dashboard for interconnect metrics.

Answer

tcpdump on the on-premises router.

Question 10

A company is setting up HA VPN between GCP and an on-premises network. They need to configure two VPN tunnels for high availability. Which of the following is required for the HA VPN gateway?

Accepted Answer

Two external IP addresses, one for each interface.. An HA VPN gateway has two interfaces, each with its own external IP address. This allows two tunnels to be established for redundancy.

Answer

A single external IP address shared by both interfaces.

Answer

A Cloud Router with BGP enabled on both tunnels.

Answer

A dedicated interconnect circuit.

Question 11

A network engineer is troubleshooting a failing HA VPN tunnel. They need to view VPN gateway logs to identify the issue. Which Google Cloud service should they use to access the logs?

Accepted Answer

Cloud Logging. Cloud Logging captures logs from Cloud VPN gateways, including tunnel events, IKE negotiations, and error messages.

Answer

Cloud Audit Logs

Answer

Cloud Debugger

Answer

Cloud Monitoring

Question 12

A company wants to use HA VPN with route-based VPN. Which VPN configuration option must be enabled?

Accepted Answer

Route-based VPN by selecting Dynamic Routing (BGP) or using static routes.. Route-based VPN uses routing (BGP or static routes) to determine which traffic goes through the tunnel, as opposed to policy-based which uses security policies.

Answer

IKEv1 with pre-shared keys.

Answer

Using certificates instead of pre-shared keys.

Answer

Policy-based VPN with multiple policies for each subnet.

Question 13

An engineer needs to monitor the operational status of a Dedicated Interconnect link. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The Cloud Monitoring metric interconnect/link/operational_status reports the operational state of a Dedicated Interconnect link (e.g., LINK_OPERATIONAL, LINK_DOWN), which is exactly what is needed to monitor link health. It is the link-level status metric, distinct from attachment-level metrics.

Answer

interconnect/attachment/operational_status

Answer

interconnect/network/sent_bytes_count

Answer

interconnect/network/received_bytes_count

Question 14

A company needs to resolve on-premises DNS names from Google Cloud VMs. They want to forward DNS queries for a specific domain (example.corp) to an on-premises DNS server. Which Cloud DNS feature should they use?

Accepted Answer

Outbound DNS forwarding (conditional forwarding). Outbound DNS forwarding with conditional forwarding allows Cloud DNS to forward queries for a specific domain (example.corp) to an on-premises DNS server. This is the correct feature because it selectively routes DNS traffic based on the domain name, enabling resolution of private on-premises names from Google Cloud VMs without exposing the entire VPC network.

Answer

Private DNS zones

Answer

DNS peering

Answer

Inbound DNS policy

Question 15

A company has two HA VPN tunnels between GCP and on-premises. They want to use both tunnels simultaneously for load balancing traffic. Which BGP feature should they configure on the Cloud Router to achieve equal-cost multipath (ECMP)?

Accepted Answer

Advertise identical routes with equal BGP metrics (AS path length, MED, etc.) from both tunnels.. ECMP is achieved by having multiple BGP paths with equal MED and AS path length. The Cloud Router automatically load balances if routes have equal metrics.

Answer

Use AS path prepending on one tunnel.

Answer

Set different MED values on each tunnel to prefer one.

Answer

Enable policy-based VPN instead of route-based.