PCNE Implementing Hybrid Interconnectivity Practice Test 3 — 15 Questions

Question 1

An organization wants to connect their on-premises network to Google Cloud using a Dedicated Interconnect. They have ordered a circuit from a network service provider and need to determine the correct co-location facility to connect to. Which factor is most critical when selecting a co-location facility?

Accepted Answer

The facility must be a Google Cloud partner facility with access to a Google PoP in the same metro as the on-premises data center.. The co-location facility must be a Google Cloud partner facility that provides access to a Google Point of Presence (PoP) in the same metro area as the organization's on-premises data center to minimize latency and meet SLA requirements.

Answer

The facility must offer Layer 2 connectivity to the Google Cloud VPC.

Answer

The facility must support 100 Gbps ports to maximize throughput.

Answer

The facility must be in a different continent to ensure geographic redundancy.

Question 2

A network engineer is setting up a Dedicated Interconnect between an on-premises network and Google Cloud. After the circuit is ordered and the physical connection is established at the co-location facility, what is the first step to configure the interconnect inside GCP?

Accepted Answer

Create a VLAN attachment to associate with the interconnect.. After the physical connection is ready, you must create a VLAN attachment in Google Cloud to define the connection between your VPC and the interconnect.

Answer

Configure a VPN tunnel for backup connectivity.

Answer

Enable Cloud NAT for outbound traffic.

Answer

Create a Cloud Router with BGP sessions.

Question 3

A company is using Partner Interconnect to connect their on-premises network to Google Cloud. They need to choose between Layer 2 and Layer 3 connectivity options offered by the service provider. Which statement correctly describes the difference between Layer 2 and Layer 3 connectivity in Partner Interconnect?

Accepted Answer

Layer 3 connectivity requires the customer to have a BGP session with the partner's router, while Layer 2 allows direct BGP with Google Cloud.. With Layer 2, the partner provides a transparent VLAN; with Layer 3, the partner handles the IP routing, requiring a BGP session from the customer's on-prem router to the partner's router.

Answer

Layer 2 connectivity requires the customer to configure BGP with Google Cloud, while Layer 3 does not require any BGP on the customer side.

Answer

Layer 2 connectivity is only available for Dedicated Interconnect, not Partner Interconnect.

Answer

Both Layer 2 and Layer 3 require the customer to manage VLAN attachments inside GCP.

Question 4

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

Accepted Answer

Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.. HA VPN requires two tunnels (one per interface) to form a pair. Each tunnel requires a separate BGP session to provide redundancy.

Answer

Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.

Answer

Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.

Answer

Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.

Question 5

A network engineer is troubleshooting a Cloud VPN gateway that is not establishing a VPN tunnel with an on-premises device. The engineer checks the Cloud VPN gateway logs and sees the error 'IKE SA negotiation failed due to mismatched authentication method'. What is the most likely cause?

Accepted Answer

The authentication method is set to 'pre-shared key' on one side and 'certificate' on the other.. The error indicates a mismatch between the authentication methods configured on both ends, such as pre-shared key vs certificate, or different authentication types.

Answer

The pre-shared keys on both ends do not match.

Answer

The VPN gateway is using the wrong external IP address.

Answer

The IKE version configured on the on-premises device is IKEv1 while Cloud VPN only supports IKEv2.

Question 6

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

Accepted Answer

The passive VLAN attachment does not have BGP session configured with Cloud Router.. For failover to work with active-passive, the passive connection must have its own VLAN attachment and Cloud Router BGP session with the same routes, but with a higher MED value to be less preferred. If the VLAN attachment is not created, there is no path.

Answer

The SLA requires two circuits in different metro areas for failover.

Answer

The on-premises router is not configured to use the passive connection.

Answer

The passive connection is in a different metro area, causing higher latency.

Question 7

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They want to prioritize traffic from on-premises to GCP over one VPN tunnel when multiple tunnels are available. Which BGP attribute should they configure on their on-premises router?

Accepted Answer

AS path prepending. AS path prepending makes a route less preferred by adding AS numbers to the path, which influences inbound traffic direction. To prioritize a tunnel, you would use a shorter AS path (or no prepending) on the preferred tunnel.

Answer

MED (Multi-Exit Discriminator)

Answer

Origin attribute

Answer

Local Preference (LP)

Question 8

A company needs to resolve DNS queries from their Google Cloud VPC for on-premises hostnames (e.g., internal.mycompany.com). They have a Cloud VPN tunnel between GCP and on-premises. Which approach should they use?

Accepted Answer

Create a DNS forwarding zone in Cloud DNS that points to the on-premises DNS server IPs via the Cloud Router.. Cloud DNS forwarding zones allow you to forward queries for a specific domain (e.g., internal.mycompany.com) to on-premises DNS servers via the VPN tunnel.

Answer

Configure an outbound DNS forwarding policy with Cloud Router to forward queries to on-premises DNS servers.

Answer

Create a Cloud DNS private zone and add A records for each on-premises host.

Answer

Set up a BIND server on a Compute Engine instance and configure it as a forwarder.

Question 9

A network engineer is configuring an HA VPN tunnel pair between an on-premises VPN device and Google Cloud. The engineer wants to use IKEv2 with pre-shared keys. After configuring both ends, the tunnels do not come up. The engineer sees 'IKE SA negotiation failed - no proposal chosen' in the logs. What is the most likely cause?

Accepted Answer

The encryption algorithm (e.g., AES256) or DH group (e.g., 14) does not match between the two ends.. This error typically indicates a mismatch in IKE proposal parameters such as encryption algorithm, integrity algorithm, DH group, or SA lifetime.

Answer

The on-premises device is behind NAT and the VPN gateway does not support NAT traversal.

Answer

The IKE version on the on-premises device is set to IKEv1 while Cloud VPN expects IKEv2.

Answer

The pre-shared keys on both ends are different.

Question 10

A company has two Dedicated Interconnect circuits in different metro areas to meet the 99.99% SLA. They have configured active-active mode. During a test, they intentionally bring down one circuit. They expect traffic to continue using the other circuit, but they notice packet loss during the failover. What could be the cause?

Accepted Answer

The remaining circuit does not have sufficient bandwidth to handle the combined traffic load.. In active-active mode, both circuits are used simultaneously. When one fails, traffic is re-routed to the remaining one. If there is insufficient bandwidth on the remaining circuit, packet loss may occur due to congestion.

Answer

The VLAN attachments are not configured with the same Cloud Router.

Answer

The BGP timers are set too high, causing slow convergence.

Answer

The on-premises router is not configured with equal-cost multipath (ECMP).

Question 11

A network engineer wants to monitor the operational status of a Dedicated Interconnect link using Cloud Monitoring. Which metric should they use to check if the physical link is up or down?

Accepted Answer

interconnect/link/operational_status. The metric `interconnect/link/operational_status` directly indicates whether the physical link is up (1) or down (0).

Answer

interconnect/network/received_bytes_count

Answer

vpn/tunnel/status

Answer

interconnect/network/packets_dropped_percent

Question 12

A company is using Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer has created a VLAN attachment of type PARTNER_PROVIDER in Google Cloud. What must the service provider do to complete the connection?

Accepted Answer

Create a VLAN attachment of type PARTNER on their end and associate it with the customer's VLAN attachment.. With PARTNER_PROVIDER type, the service provider must attach the VLAN to their network and configure the connection on their side. The provider also needs to set up BGP peering with the customer's on-premises router if using Layer 3, but for Layer 2, BGP is between customer and Google.

Answer

Provide the engineer with a pairing key to attach the VLAN attachment to the interconnect.

Answer

Assign a public IP address to the VLAN attachment.

Answer

Configure BGP routing with the customer's on-premises router.

Question 13

A network engineer is configuring a route-based VPN tunnel between an on-premises network and Google Cloud using Cloud VPN. Which two statements are true about route-based VPN compared to policy-based VPN? (Choose two.)

Accepted Answer

Route-based VPNs automatically route traffic based on the routing table entries.. Route-based VPNs use routing tables (like BGP) to determine which traffic is sent through the tunnel, and they support dynamic routing protocols like BGP.

Answer

Route-based VPNs are less flexible than policy-based VPNs for traffic selection.

Answer

Route-based VPNs require static routes to be configured manually.

Answer

Route-based VPNs require separate security policies for each traffic flow.

Question 14

A company has two Dedicated Interconnect connections in different metro areas to meet the 99.99% SLA. They want to ensure that traffic uses both connections in an active-active manner. Which three configurations are required? (Choose three.)

Accepted Answer

Configure BGP on both VLAN attachments with equal MED values.. For active-active, you need two VLAN attachments (one per connection), both attached to the same Cloud Router, and you must configure BGP on both attachments with the same route preferences (e.g., equal MED) to enable ECMP.

Answer

Create a single VLAN attachment shared across both connections.

Answer

Set the VLAN attachments to use static routing instead of BGP.

Question 15

A network engineer is troubleshooting a VPN tunnel that is up but not passing traffic. The Cloud Router shows that BGP sessions are established, but routes are not being exchanged. Which two should the engineer check? (Choose two.)

Accepted Answer

Ensure that the firewall rules in the VPC allow traffic from the on-premises IP ranges.. Common issues: incorrect firewall rules blocking the traffic, or the route advertisements are not configured correctly (e.g., not advertising the correct prefixes).

Answer

Verify that the Cloud Router is using the correct ASN.

Answer

Check that the Cloud VPN gateway has the correct pre-shared key configured.

Answer

Confirm that the VLAN attachment is of type PARTNER_PROVIDER.