PCNE Implementing Hybrid Interconnectivity Practice Test 17 — 15 Questions

Question 1

You are troubleshooting a failing HA VPN tunnel between GCP and on-premises. The tunnel status shows 'Tunnel is down' in Cloud Console. Which TWO steps should you take to diagnose the issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the on-premises firewall rules to ensure UDP ports 500 and 4500 are allowed. Checking Cloud VPN gateway logs for IKE errors helps identify authentication or configuration mismatch. Verifying that the on-premises firewall allows UDP 500 and 4500 for IPsec is necessary because many failures are due to firewall blocking.

Answer

Confirm that the GCP VPC has a firewall rule allowing inbound IPsec traffic

Answer

Verify that the Cloud Router BGP session is established

Answer

Ensure that the on-premises VPN gateway has a static route to the GCP VPC

Question 2

A company has two Dedicated Interconnect connections from different metro areas to their GCP VPC. They want to use both connections actively (active-active load balancing) without manual intervention. Which TWO configurations are required to achieve this? (Choose two.)

Accepted Answer

Advertise the same on-premises prefix with the same MED on both BGP sessions. To use active-active, you must configure ECMP on the Cloud Router to load balance across both BGP sessions, and advertise the same prefixes with equal priority (same MED) from both on-premises routers.

Answer

Use AS path prepending on one of the BGP sessions

Answer

Create two separate Cloud Routers

Answer

Set different MED values on each BGP session

Question 3

Your organization operates a Dedicated Interconnect connection in the metro of Amsterdam. The on-premises router advertises a default route (0.0.0.0/0) to the Cloud Router, and you want the VPC to use this route for all destinations not covered by more specific routes. After you configure the Cloud Router BGP session, you notice that the default route is not installed in the VPC routing table. What should you do?

Accepted Answer

Configure a custom import policy on the Cloud Router to accept the default route.. Cloud Router does not accept a default route (0.0.0.0/0) from a BGP peer unless you explicitly configure a custom import policy to allow it. Without that policy, the route is rejected and never installed in the VPC. Enabling global routing or manipulating BGP attributes does not override this default behavior.

Answer

Advertise the default route from the VPC to on-premises using a custom export policy.

Answer

Set the advertised route priority to a lower value than other routes.

Answer

Enable global routing on the Cloud Router.

Question 4

You need to connect your on-premises network to Google Cloud using a Partner Interconnect connection. Your service provider offers Layer 2 connectivity and requires you to provide a VLAN ID. Which Google Cloud resource must you create to establish the connection?

Accepted Answer

A VLAN attachment. For Partner Interconnect, you create a VLAN attachment to connect your VPC to the service provider's network. The VLAN attachment is associated with a Cloud Router and uses the VLAN ID provided by the service provider. This is the fundamental step to establish connectivity.

Answer

A Cloud VPN tunnel

Answer

A Dedicated Interconnect connection

Answer

A Cloud Router

Question 5

A network engineer is configuring a Partner Interconnect connection using a Layer 2 service provider. The engineer has created a VLAN attachment in the Google Cloud Console and provided the pairing key to the service provider. The service provider reports that the connection is up, but the VLAN attachment in Google Cloud shows 'Down'. The engineer verifies that the Cloud Router is up and the BGP session is not established. What is the most likely cause?

Accepted Answer

The service provider has not configured the correct VLAN ID on their side to match the VLAN attachment.. A VLAN attachment showing 'Down' despite the service provider reporting the connection is up usually indicates a Layer 2 mismatch. The most common cause is a VLAN ID mismatch between the Google Cloud VLAN attachment and the service provider's configuration. The engineer should verify that the VLAN ID configured on the service provider side matches the one in the VLAN attachment. Once corrected, the attachment should come up and BGP can establish.

Answer

The VLAN attachment's MTU is set to 1500, but the service provider requires 1440.

Answer

The VLAN attachment was created in a region that does not support Partner Interconnect.

Answer

The Cloud Router's BGP ASN is set to 16550, which is reserved for Google.

Question 6

A multinational corporation has a Dedicated Interconnect connection between its on-premises network and Google Cloud. They use Cloud Router with BGP. The on-premises router is configured to advertise routes with a MED of 100. The company wants to ensure that traffic from the VPC to on-premises uses the Dedicated Interconnect link and not a backup Cloud VPN tunnel. However, they notice that some traffic is being sent over the VPN tunnel. What is the most likely cause?

Accepted Answer

The Cloud VPN tunnel is advertising more specific routes than the Dedicated Interconnect.. For outbound traffic from the VPC to on-premises, Cloud Router uses the longest prefix match first. If the Cloud VPN tunnel advertises more specific routes for certain prefixes, those routes will be installed and preferred over the less specific routes from the Dedicated Interconnect, causing traffic to use the VPN for those destinations.

Answer

The Cloud VPN tunnel has a lower priority than the Dedicated Interconnect.

Answer

The Cloud Router is not configured to use global routing.

Answer

The MED value on the Dedicated Interconnect is higher than on the Cloud VPN tunnel.

Question 7

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They need to determine the required steps to establish the connection. Which of the following is the first step they must take?

Accepted Answer

Order a Dedicated Interconnect connection through the Google Cloud Console.. To establish a Dedicated Interconnect connection, the first action is to order the connection through the Google Cloud Console. After ordering, Google provides the necessary details to provision a cross-connect in a colocation facility. Once the physical connection is active, you can create VLAN attachments and configure Cloud Router.

Answer

Create a VLAN attachment in the Google Cloud Console.

Answer

Configure a Cloud Router in the same region as the Dedicated Interconnect.

Answer

Provision a cross-connect in a Google colocation facility.

Question 8

A network engineer needs to connect a VPC to an on-premises network using a Cloud VPN. The on-premises VPN device supports only IKEv1. Which Google Cloud VPN configuration should the engineer use?

Accepted Answer

Classic VPN with IKEv1 and a static route.. Classic VPN supports IKEv1, making it the only Google Cloud VPN option compatible with an on-premises device that only supports IKEv1. HA VPN requires IKEv2, so it cannot be used. The engineer should configure Classic VPN with appropriate routing and IKEv1 settings.

Answer

Partner Interconnect with a VLAN attachment and IKEv1.

Answer

HA VPN with two tunnels and IKEv2.

Answer

HA VPN with a single tunnel and IKEv1.

Question 9

A network engineer is configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. The on-premises ASN is 65001 and the engineer sets the Cloud Router ASN to 65001. BGP fails to establish. What is the most likely cause?

Accepted Answer

The Cloud Router ASN must differ from the on-premises ASN because eBGP requires different autonomous system numbers on each side of the session.. An external BGP session requires the two peers to be in different autonomous systems. When Cloud Router and the on-premises router both use ASN 65001, the session cannot form. Assigning Cloud Router a distinct private ASN, for example 65002, resolves the collision and lets the eBGP session establish over the VLAN attachment.

Answer

Cloud Router only supports ASN 16550, so any custom ASN prevents the session from establishing.

Answer

The VLAN attachment must be deleted and recreated with a different ASN, because the ASN is immutable after creation.

Answer

The on-premises router must be configured as an iBGP peer because Cloud Router emulates an internal BGP speaker.

Question 10

A company has a Partner Interconnect connection with a service provider. The VLAN attachment is up, and BGP sessions are established. However, the on-premises network cannot reach certain VM instances in the VPC. The engineer suspects that the issue is with the MTU. What is the maximum MTU supported for Partner Interconnect?

Accepted Answer

8896 bytes. Partner Interconnect supports a maximum MTU of 8896 bytes, which is higher than the standard 1500 bytes. This allows for jumbo frames and improved efficiency. The engineer should ensure that the on-premises network and service provider also support this MTU to avoid fragmentation or packet drops.

Answer

1460 bytes

Answer

9000 bytes

Answer

1500 bytes

Question 11

A company needs to connect its on-premises network to Google Cloud using a Partner Interconnect connection. The company's data center is in a city where Google Cloud does not have a Dedicated Interconnect location. The service provider offers a Layer 2 connection to Google Cloud. What should the network engineer do to establish connectivity?

Accepted Answer

Create a VLAN attachment on the Partner Interconnect connection and associate it with a Cloud Router.. Partner Interconnect enables connectivity through a service provider. The service provider establishes a connection to Google's network. You then create a VLAN attachment, which is a logical connection over the Partner Interconnect, and associate it with a Cloud Router. The Cloud Router uses BGP to exchange routes with your on-premises router. This provides private connectivity without needing a Dedicated Interconnect location. The VLAN attachment is the key resource that links your VPC to the Partner Interconnect.

Answer

Configure an HA VPN over the Partner Interconnect connection to encrypt traffic.

Answer

Order a Dedicated Interconnect connection from Google Cloud and have the service provider extend the circuit.

Answer

Use Cloud VPN over the public internet to connect to the on-premises network.

Question 12

A network engineer has configured a Cloud Router with a BGP session to an on-premises router over a Dedicated Interconnect. The engineer wants to ensure that the on-premises router prefers routes learned from the Cloud Router over its default route to the internet. Which BGP attribute should the engineer configure on the on-premises router?

Accepted Answer

Set a higher local preference for routes learned from the Cloud Router.. Local preference is a well-known BGP attribute used to select the preferred outbound path. A higher local preference is preferred. By configuring a higher local preference for routes learned from the Cloud Router, the on-premises router will prefer those routes over its default route to the internet. This ensures that traffic destined for Google Cloud uses the Dedicated Interconnect connection, while other traffic continues to use the default route. This is a standard BGP traffic engineering technique.

Answer

Set a higher AS path length for routes learned from the Cloud Router.

Answer

Set a lower MED (Multi-Exit Discriminator) for routes learned from the Cloud Router.

Answer

Set a higher weight for routes learned from the Cloud Router.

Question 13

A network engineer is configuring a Partner Interconnect connection with a service provider. The provider offers a Layer 2 connection and requires the engineer to provide a VLAN ID for the attachment. The engineer creates a VLAN attachment in Google Cloud and provides the VLAN ID to the provider. However, the attachment remains in a 'Pending' state. What is the most likely reason?

Accepted Answer

The service provider has not yet configured the VLAN on their end.. A VLAN attachment for Partner Interconnect remains in 'Pending' state until the service provider completes their configuration. The engineer must provide the VLAN ID and other details to the provider, and the provider must activate the connection on their end. Once the provider finishes, the attachment becomes 'Active'. Therefore, the most likely reason is that the provider has not yet configured the VLAN.

Answer

The engineer did not configure the Cloud Router for the VLAN attachment.

Answer

The VLAN attachment was created in a region that is not supported by the service provider.

Answer

The VLAN ID provided is not unique within the VPC network.

Question 14

A company has a Cloud Router in us-central1 managing a Dedicated Interconnect VLAN attachment. They want to advertise a custom IP range (192.168.100.0/24) to their on-premises network, but they do not want to advertise any VPC subnets. How should they configure the Cloud Router?

Accepted Answer

Enable custom advertisement and add 192.168.100.0/24 as an advertised range.. The Cloud Router's advertisement mode determines what routes it advertises to BGP peers. By default, it advertises all subnets in the VPC network. To advertise only a specific custom range and suppress VPC subnets, you must enable custom advertisement and add the desired range. This ensures that only 192.168.100.0/24 is advertised, and no VPC subnets are advertised.

Answer

Keep default advertisement and add 192.168.100.0/24 as a custom range.

Answer

Use a route policy to filter out VPC subnets and allow only 192.168.100.0/24.

Answer

Create a static route for 192.168.100.0/24 and enable route advertisement.

Question 15

Your organization has a Dedicated Interconnect connection in the us-central1 region with a single VLAN attachment and a Cloud Router. You need to add a second VLAN attachment on the same Dedicated Interconnect to provide redundancy, but you want to avoid a single point of failure in the Cloud Router. What should you do?

Accepted Answer

Create a second VLAN attachment on the same Dedicated Interconnect and associate it with a new Cloud Router.. To avoid a single point of failure in the Cloud Router when using Dedicated Interconnect, you must use two Cloud Routers, each associated with a separate VLAN attachment on the same interconnect. This way, if one Cloud Router fails, the other maintains BGP sessions and route advertisement. Associating both attachments with one router leaves that router as a single point of failure.

Answer

Create a second VLAN attachment on the same Dedicated Interconnect and associate it with the existing Cloud Router.

Answer

Create a new Dedicated Interconnect connection in a different region and attach it to the existing Cloud Router.

Answer

Convert the existing VLAN attachment to a Partner Interconnect attachment and add a second attachment.