PCNE Implementing Hybrid Interconnectivity Practice Test 3 — 15 Questions

Question 1

A network engineer is configuring a Cloud VPN tunnel with route-based VPN and BGP. The tunnel is established, but the Cloud Router does not learn any routes from the on-premises peer. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The BGP session is not configured on the VPN tunnel.. The most likely cause because the BGP session must be explicitly configured on the VPN tunnel interface for route exchange. Option A is incorrect because BGP uses TCP port 179, not UDP. Option D is incorrect because a Cloud Router without an ASN would not establish a BGP session, but this is not a given in the scenario; however, the question asks for the most likely cause, and the tunnel being established suggests the VPN is up, but BGP configuration is missing. Option C is incorrect because not all options are possible causes (A and D are not valid).

Answer

Firewall rules on the on-prem router block UDP port 179.

Answer

All of the above are possible causes.

Answer

The Cloud Router does not have an ASN configured.

Question 2

An on-premises router uses BGP ASN 64512. The Cloud Router is also configured with ASN 64512. When the BGP peering is established, what behavior is expected?

Accepted Answer

The BGP session will fail or behave unpredictably.. BGP requires each router in a peering session to have a unique ASN to properly enforce loop prevention and path selection. When both the on-premises router and Cloud Router use the same ASN 64512, the BGP session will fail or behave unpredictably because each router will see its own ASN in received updates, triggering the BGP loop detection mechanism (RFC 4271, Section 9.3) and causing the session to drop or routes to be rejected.

Answer

The session works but routes are not exchanged.

Answer

Cloud Router will automatically prepend its ASN to avoid conflict.

Answer

The BGP session works normally since ASN 64512 is a private ASN.

Question 3

A company is using Partner Interconnect to connect to Google Cloud. They notice that traffic from on-premises to GCP takes one path, but return traffic takes a different path, causing asymmetric routing. How can they resolve this?

Accepted Answer

Apply BGP MED values to influence path selection.. B is correct because applying BGP MED (Multi-Exit Discriminator) values allows you to influence the path selection for return traffic from Google Cloud to your on-premises network. By setting a lower MED value on one of the Partner Interconnect connections, you can make Google Cloud prefer that path for return traffic, thereby matching the forward path and resolving asymmetric routing. This is a standard BGP technique for controlling inbound traffic to an AS.

Answer

Configure the same BGP ASN on both sides.

Answer

Enable asymmetric routing mode on the Cloud Router.

Answer

Use different link-local addresses for each session.

Question 4

A Dedicated Interconnect VLAN attachment is in ACTIVE state. The Cloud Router has learned routes from on-premises, and the on-premises router has learned routes from GCP. However, traffic from on-premises to a GCP VM fails. What should the engineer check first?

Accepted Answer

Both A and C.. Both firewall rules and VPC subnet routes must be in place for traffic to reach a GCP VM. Even if the VLAN attachment is ACTIVE and routes are exchanged, the VPC firewall must permit ingress from the on-premises range, and the VPC subnet routes must exist in the routing table for the VM's subnet. Without both, traffic will be dropped or not forwarded.

Answer

Check firewall rules on the GCP VPC for ingress from the on-premises range.

Answer

Confirm that the Cloud Router is advertising the on-premises subnets back to the VPC.

Answer

Verify that the VPC subnet routes exist in the routing table.

Question 5

What is the maximum number of VLAN attachments that can be configured on a single 10 Gbps Dedicated Interconnect connection?

Accepted Answer

8. A single 10 Gbps Dedicated Interconnect connection supports a maximum of 8 VLAN attachments. This limit is defined by Google Cloud's interconnect architecture, where each VLAN attachment consumes a portion of the 10 Gbps bandwidth and is mapped to a unique VLAN ID. The 8-attachment cap ensures predictable performance and avoids oversubscription on the physical link.

Answer

16

Answer

4

Answer

2

Question 6

A customer is configuring a route-based IPsec VPN tunnel to Google Cloud. On their on-premises router, they must specify traffic selectors (proxy IDs). What should they set the local and remote traffic selectors to?

Accepted Answer

Set both local and remote traffic selectors to 0.0.0.0/0.. For a route-based IPsec VPN to Google Cloud, the traffic selectors (proxy IDs) must be set to 0.0.0.0/0 on both local and remote to allow any traffic, because Google Cloud's HA VPN uses route-based selection and does not support specific traffic selectors. This ensures that all traffic destined for the VPC is encrypted and routed correctly.

Answer

Configure IKE version to match.

Answer

Set local to on-prem subnet and remote to VPC subnet.

Answer

Use policy-based VPN instead.

Question 7

Which TWO configurations provide high availability for Dedicated Interconnect? (Choose two.)

Accepted Answer

Two connections to different PoPs.. Option A is correct because terminating two Dedicated Interconnect connections in different Points of Presence (PoPs) ensures that a failure of an entire PoP or its associated metro facility does not take down all connectivity, providing geographic diversity and true high availability. Option E is correct because two connections to the same PoP still provide redundancy at the circuit and port level, so if one Dedicated Interconnect connection or its associated link fails, traffic can fail over to the second connection within that PoP, maintaining availability. Option B is incorrect because a single circuit with L2 redundancy still relies on one physical path and one PoP, so it does not protect against a failure of that circuit or facility. Option C is incorrect because Cloud NAT is a managed NAT service for outbound internet access from private instances, not a failover mechanism for Dedicated Interconnect. Option D is incorrect because a single connection from one provider offers no redundancy and is a single point of failure.

Answer

A single circuit with L2 redundancy.

Answer

Using Cloud NAT for failover.

Answer

A single connection from one provider.

Question 8

Which THREE factors can affect the throughput of a Cloud VPN tunnel? (Choose three.)

Accepted Answer

Tunnel type (route-based vs policy-based). Option C is correct because the tunnel type affects throughput: policy-based (static) VPN tunnels are limited to a single SA per tunnel and generally cap at lower throughput, while route-based (dynamic) tunnels support multiple SAs and can achieve higher aggregate throughput. Option D is correct because the encryption algorithm (and integrity/authentication algorithm) determines how much CPU work each packet requires; stronger or less efficient ciphers such as AES-256-CBC with SHA-256 consume more processing per packet than AES-128-GCM, directly lowering achievable throughput. Option E is correct because the on-premises router's CPU capacity is often the bottleneck: IPsec encryption/decryption is CPU-intensive, so a router with insufficient processing power cannot saturate the tunnel even if the cloud side and network bandwidth allow it. Option A is not correct because the VM instance type on the Cloud VPN side is not a throughput factor — Cloud VPN is a managed HA VPN service whose throughput is governed by the number of tunnels and the peer device, not by a customer-selectable VM instance type. Option B is not correct in this context because, while each tunnel has its own throughput limit, the number of tunnels is not itself a factor that changes the throughput of a given tunnel; throughput per tunnel is determined by tunnel type, encryption, and the peer device's capacity.

Answer

VM instance types

Answer

Number of tunnels

Question 9

A company wants to connect an on-premises network to Google Cloud using Cloud VPN. The on-premises network has a single subnet and no dynamic routing capabilities. The company needs a simple, low-cost solution. Which VPN configuration should they choose?

Accepted Answer

Classic VPN with route-based configuration. Classic VPN with route-based configuration is the correct choice because the on-premises network lacks dynamic routing capabilities and requires a simple, low-cost solution. Route-based VPNs use static routes and do not require BGP, making them ideal for environments without dynamic routing support. Classic VPN is the legacy, lower-cost option compared to HA VPN, and route-based configuration allows traffic to be forwarded based on routing table entries rather than policy-based selectors.

Answer

HA VPN with dynamic routing (BGP)

Answer

HA VPN with static routing

Answer

Classic VPN with policy-based configuration

Question 10

An engineer is configuring Dedicated Interconnect between an on-premises data center and Google Cloud. Cloud Router is set up with BGP sessions. The BGP session remains in Idle state. Which of the following is the most likely cause?

Accepted Answer

The Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface.. The BGP session remains in Idle state because the Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface. For BGP peering over Dedicated Interconnect, the two routers must be directly connected at Layer 3, meaning their BGP peer IP addresses must belong to the same /30 or /31 subnet. If they are in different subnets, the TCP connection for BGP cannot be established, keeping the session in Idle state.

Answer

The on-premises router is not advertising the Google Cloud VPC subnet routes.

Answer

The interconnect is not configured with redundant links.

Answer

The VLAN attachment is not in the same region as the Cloud Router.

Question 11

A company has two Dedicated Interconnect connections to two separate Google Cloud regions for redundancy. They use Cloud Router with BGP to exchange routes. They want to ensure that traffic from on-premises to a specific VPC in us-central1 uses only the interconnect to us-central1, and the other interconnect is used only as a backup. How can they achieve this?

Accepted Answer

Configure MED values on the on-premises router to prefer the us-central1 interconnect.. Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to a specific entry point. By setting a lower MED value on the on-premises router for the routes advertised via the us-central1 interconnect, the on-premises network will prefer that path for traffic destined to the VPC in us-central1. The other interconnect will only be used if the preferred path fails, providing the desired active/backup behavior.

Answer

Configure BGP communities on Google Cloud to prefer the us-central1 interconnect.

Answer

Configure AS path prepending on the on-premises router to make the us-central1 path longer.

Answer

Use Cloud Router's custom route advertisements to influence path selection.

Question 12

An enterprise uses HA VPN to connect their on-premises network to Google Cloud. The on-premises side has a single VPN device that supports BGP. They want to maximize availability. What is the recommended Google Cloud configuration?

Accepted Answer

Deploy a single Cloud VPN gateway with two interfaces, each with its own external IP, and configure two BGP sessions to the single on-premises device.. It provides high availability by using a single Cloud VPN gateway with two interfaces, each with its own external IP, and two BGP sessions to the on-premises device. This configuration allows active/active failover: if one interface or BGP session fails, traffic automatically switches to the other, maximizing availability without requiring multiple regions.

Answer

Deploy two Cloud VPN gateways in different regions to provide regional failover.

Answer

Deploy a single Cloud VPN gateway with one interface and one BGP session.

Answer

Deploy a single Cloud VPN gateway with two interfaces, but only use one BGP session for simplicity.

Question 13

Company A and Company B both have networks in Google Cloud. They want to connect their VPCs using VPC peering, but they have overlapping IP addresses. How can they resolve this?

Accepted Answer

Use Cloud VPN to establish connectivity between the VPCs, as VPC peering cannot handle overlapping IPs.. VPC peering in Google Cloud requires that the VPC networks have non-overlapping IP address ranges; if they overlap, peering cannot be established. To connect VPCs with overlapping IPs, you must use a different connectivity method such as Cloud VPN (or Cloud Interconnect) with NAT, which can translate addresses between the two networks. Cloud VPN supports overlapping IPs when you configure NAT on the VPN gateways or use a third-party appliance.

Answer

Configure Private Service Connect to connect the VPCs.

Answer

Configure VPC peering with custom route exchange to exclude the overlapping subnets.

Answer

Use Dedicated Interconnect to connect the VPCs through a central router.

Question 14

A network engineer is configuring Cloud Router for Dedicated Interconnect. The on-premises router is advertising a route to 10.1.0.0/16. The engineer wants to ensure that Google Cloud always prefers this route over other routes learned from different on-premises routers. Which BGP attribute should be set on the on-premises router?

Accepted Answer

MED. MED (Multi-Exit Discriminator) is the correct BGP attribute to influence inbound traffic from Google Cloud to prefer a specific on-premises router when multiple paths exist. By setting a lower MED value on the on-premises router, the Cloud Router will select that route over others with higher MED values, ensuring Google Cloud always prefers this path for traffic destined to 10.1.0.0/16.

Answer

NEXT_HOP

Answer

AS_PATH

Answer

LOCAL_PREF

Question 15

An engineer has configured an HA VPN tunnel between an on-premises network and Google Cloud. The tunnel status shows as established, but traffic is not flowing. The engineer checks the Cloud Router BGP session and sees it is in the Active state. What is the most likely cause?

Accepted Answer

The Cloud Router is not configured with the correct BGP IP address for the on-premises side.. The BGP session being in the Active state indicates that the Cloud Router has sent an Open message but has not received a valid response from the on-premises peer. This most commonly occurs when the BGP peer IP address configured on the Cloud Router does not match the IP address the on-premises router is using for BGP peering, preventing the TCP connection on port 179 from completing. Since the tunnel is established (IPsec is up), the issue is at the BGP layer, not the tunnel layer.

Answer

The tunnel's shared secret (pre-shared key) is mismatched.

Answer

The Cloud Router is not advertising the VPC subnet routes.

Answer

The on-premises router is not allowing BGP traffic on UDP port 179.