PCNE Implementing Hybrid Interconnectivity Practice Test 16 — 15 Questions

Question 1

A company is planning a hybrid cloud connectivity strategy with Google Cloud. They need high bandwidth (10 Gbps) and low latency. They also want to avoid internet transit. Which TWO connectivity options meet these requirements? (Choose 2.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Partner Interconnect. Partner Interconnect (B) is correct because it provides a private connection between your on-premises network and Google Cloud through a supported service provider, supporting bandwidths up to 50 Gbps per attachment (including 10 Gbps) with low latency and no internet transit. Dedicated Interconnect (C) is correct because it offers a direct physical connection at a Google colocation facility, supporting 10 Gbps or 100 Gbps circuits with low latency and traffic that bypasses the public internet entirely. CDN Interconnect (A) is not a general hybrid connectivity option; it is designed to optimize content delivery from Google Cloud CDN to specific ISP networks. Direct Peering (D) exchanges traffic between a customer network and Google's edge at an internet exchange, but it does not provide the dedicated 10 Gbps private path to a VPC that the scenario requires. Cloud VPN (E) tunnels traffic over the public internet, so it fails the requirement to avoid internet transit and does not natively deliver 10 Gbps per tunnel.

Answer

CDN Interconnect

Answer

Direct Peering

Answer

Cloud VPN

Question 2

A network engineer is setting up a Dedicated Interconnect between an on-premises network and Google Cloud. After the circuit is ordered and the physical connection is established at the co-location facility, what is the first step to configure the interconnect inside GCP?

Accepted Answer

Create a VLAN attachment to associate with the interconnect.. After the physical connection is ready, you must create a VLAN attachment in Google Cloud to define the connection between your VPC and the interconnect.

Answer

Configure a VPN tunnel for backup connectivity.

Answer

Enable Cloud NAT for outbound traffic.

Answer

Create a Cloud Router with BGP sessions.

Question 3

A company is using Partner Interconnect to connect their on-premises network to Google Cloud. They need to choose between Layer 2 and Layer 3 connectivity options offered by the service provider. Which statement correctly describes the difference between Layer 2 and Layer 3 connectivity in Partner Interconnect?

Accepted Answer

Layer 3 connectivity requires the customer to have a BGP session with the partner's router, while Layer 2 allows direct BGP with Google Cloud.. In Partner Interconnect, Layer 3 connectivity means the service provider handles the BGP peering with Google Cloud on the customer's behalf, so the customer establishes BGP with the partner's router rather than directly with Google. Layer 2 connectivity, by contrast, extends the customer's Layer 2 domain into Google Cloud, allowing the customer to run BGP directly with Google Cloud's Cloud Router over the VLAN attachment. This is the defining architectural difference between the two partner-provided connectivity models.

Answer

Layer 2 connectivity requires the customer to configure BGP with Google Cloud, while Layer 3 does not require any BGP on the customer side.

Answer

Layer 2 connectivity is only available for Dedicated Interconnect, not Partner Interconnect.

Answer

Both Layer 2 and Layer 3 require the customer to manage VLAN attachments inside GCP.

Question 4

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

Accepted Answer

Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.. A Google Cloud HA VPN gateway has two interfaces, each with its own external IP, and requires two VPN tunnels — one per interface — to achieve 99.99% availability. Each tunnel must have its own BGP session with the on-premises VPN device, and the on-premises device must be configured to peer with both. This creates the redundant tunnel pair that HA VPN is designed for.

Answer

Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.

Answer

Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.

Answer

Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.

Question 5

A network engineer is troubleshooting a Cloud VPN gateway that is not establishing a VPN tunnel with an on-premises device. The engineer checks the Cloud VPN gateway logs and sees the error 'IKE SA negotiation failed due to mismatched authentication method'. What is the most likely cause?

Accepted Answer

The authentication method is set to 'pre-shared key' on one side and 'certificate' on the other.. The error 'IKE SA negotiation failed due to mismatched authentication method' indicates that the two VPN peers are configured with different authentication methods. One side is using pre-shared key (PSK) and the other is using certificates, so they cannot agree on how to authenticate. This is a common misconfiguration in Cloud VPN setups.

Answer

The pre-shared keys on both ends do not match.

Answer

The VPN gateway is using the wrong external IP address.

Answer

The IKE version configured on the on-premises device is IKEv1 while Cloud VPN only supports IKEv2.

Question 6

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

Accepted Answer

The passive VLAN attachment does not have BGP session configured with Cloud Router.. For a Dedicated Interconnect failover to occur, the passive connection must have a VLAN attachment with a configured BGP session peering with Cloud Router. Without BGP, the passive connection cannot advertise routes or receive routes, so traffic will not fail over even if the physical link is up. The most likely reason is that the passive VLAN attachment lacks a BGP session.

Answer

The SLA requires two circuits in different metro areas for failover.

Answer

The on-premises router is not configured to use the passive connection.

Answer

The passive connection is in a different metro area, causing higher latency.

Question 7

A network engineer is configuring an HA VPN tunnel pair between an on-premises VPN device and Google Cloud. The engineer wants to use IKEv2 with pre-shared keys. After configuring both ends, the tunnels do not come up. The engineer sees 'IKE SA negotiation failed - no proposal chosen' in the logs. What is the most likely cause?

Accepted Answer

The encryption algorithm (e.g., AES256) or DH group (e.g., 14) does not match between the two ends.. This error typically indicates a mismatch in IKE proposal parameters such as encryption algorithm, integrity algorithm, DH group, or SA lifetime.

Answer

The on-premises device is behind NAT and the VPN gateway does not support NAT traversal.

Answer

The IKE version on the on-premises device is set to IKEv1 while Cloud VPN expects IKEv2.

Answer

The pre-shared keys on both ends are different.

Question 8

A network engineer wants to monitor the operational status of a Dedicated Interconnect link using Cloud Monitoring. Which metric should they use to check if the physical link is up or down?

Accepted Answer

interconnect/link/operational_status. The metric interconnect/link/operational_status is specifically designed to report the operational state of a Dedicated Interconnect link, indicating whether the physical link is up or down. It provides a boolean or enumerated status that directly reflects the link's health, making it the correct choice for monitoring physical link status. Other metrics focus on traffic volume or errors, not operational state.

Answer

interconnect/network/received_bytes_count

Answer

vpn/tunnel/status

Answer

interconnect/network/packets_dropped_percent

Question 9

A network engineer is configuring a route-based VPN tunnel between an on-premises network and Google Cloud using Cloud VPN. Which two statements are true about route-based VPN compared to policy-based VPN? (Choose two.)

Accepted Answer

Route-based VPNs automatically route traffic based on the routing table entries.. Option A is correct because a route-based VPN (virtual tunnel interface) selects traffic by looking up the destination in the routing table rather than matching a policy, so any packet whose route points to the tunnel is encrypted and forwarded. Option C is correct because route-based VPNs can run dynamic routing protocols such as BGP over the tunnel, which is exactly how Cloud VPN (HA VPN) advertises on-premises and VPC routes and supports route exchange. Option B is wrong because route-based VPNs are generally more flexible, not less, since they do not need a policy per subnet pair and can carry any traffic the routing table directs into the tunnel. Option D is wrong because route-based VPNs do not require manually configured static routes; they commonly use dynamic routing (BGP) or learned routes, and static routes are only one optional method. Option E is wrong because route-based VPNs do not need a separate security policy for each traffic flow; traffic selection is handled by the routing table, not by per-flow policy objects.

Answer

Route-based VPNs are less flexible than policy-based VPNs for traffic selection.

Answer

Route-based VPNs require static routes to be configured manually.

Answer

Route-based VPNs require separate security policies for each traffic flow.

Question 10

A company wants to establish a dedicated physical connection between their on-premises network and Google Cloud. They need a 10 Gbps connection and are willing to manage the circuit and colocation facility themselves. Which Google Cloud service should they use?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection between the on-premises network and Google's network via a colocation facility and Google Partner PoP. It is managed by the customer for circuit ordering and colocation.

Answer

Partner Interconnect

Answer

Cloud CDN

Answer

Cloud VPN

Question 11

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The metric 'interconnect/link/operational_status' provides the operational status of each interconnect link (e.g., operational, degraded).

Answer

interconnect/vlan_attachment/outbound_bytes

Answer

interconnect/network/packet_drop_count

Answer

interconnect/network/received_bytes_count

Question 12

An engineer is configuring a Cloud Router for HA VPN. They need to enable BGP on the VPN tunnels. Which BGP configuration is required for the Cloud Router to advertise the VPC subnets to the on-premises network?

Accepted Answer

Create a custom route advertisement for each subnet. Cloud Router uses Border Gateway Protocol (BGP) to dynamically exchange routes with the on-premises network over HA VPN tunnels. By default, Cloud Router advertises only the VPC subnet ranges that are directly connected to the VPC network. To ensure all VPC subnets are advertised, you must create custom route advertisements for each subnet that needs to be reachable from on-premises. This is done by configuring the Cloud Router with a custom advertisement mode and specifying the subnet CIDR ranges as custom advertised IP ranges.

Answer

Set up a VPC peering connection

Answer

Use static routes on the VPN tunnel

Answer

Configure the VPN gateway to advertise the subnets

Question 13

A company has a Partner Interconnect connection (Layer 2) with a service provider. They need to configure BGP sessions on their on-premises router and Google Cloud Router. The engineer creates a VLAN attachment of type PARTNER. However, the BGP session does not come up. What is the most likely reason?

Accepted Answer

The Cloud Router BGP IP address is not in the same subnet as the VLAN attachment. For a Partner Interconnect VLAN attachment, the Cloud Router's BGP interface IP address must fall within the same subnet as the VLAN attachment's IP range. If the BGP IP is outside that subnet, the BGP session cannot establish because the two endpoints are not on the same Layer 3 network. This is a common misconfiguration when setting up Partner Interconnect, as the Cloud Router BGP IP must be explicitly assigned from the attachment's subnet.

Answer

The VLAN attachment type should be PARTNER_PROVIDER

Answer

The IAM permissions for the Cloud Router are missing

Answer

The on-premises router is using a different BGP AS number than configured

Question 14

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

Accepted Answer

Inbound DNS policy. Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Answer

DNS peering

Answer

Outbound DNS forwarding zone

Answer

Private zone with DNS forwarding

Question 15

A company is designing a highly available hybrid network using HA VPN. They need to ensure that if one VPN tunnel fails, traffic automatically fails over to the other tunnel. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable BGP on both tunnels. Option B is correct because Cloud HA VPN relies on BGP (Border Gateway Protocol) to dynamically exchange routes between the Cloud Router and the on-premises router; when a tunnel fails, BGP withdraws its routes and the surviving tunnel's routes are used, enabling automatic failover without manual intervention. Option E is correct because a highly available HA VPN topology requires two tunnels terminating on two different interfaces (each with its own external IP) of the HA VPN gateway, so that the failure of one interface or tunnel does not take down all connectivity. Option A is incorrect because static routes do not provide dynamic failover in HA VPN; they lack the health-based route withdrawal that BGP offers. Option C is incorrect because each tunnel must terminate on a distinct peer IP address on the on-premises side to provide redundancy; using the same peer IP would defeat the purpose of separate tunnels. Option D is incorrect because pre-shared keys are per-tunnel IKE credentials and do not need to be identical; matching PSKs do not enable failover.

Answer

Configure static routes for failover

Answer

Configure both tunnels with the same peer IP address on the on-premises side

Answer

Use the same pre-shared key for both tunnels