PCNE Implementing Hybrid Interconnectivity Practice Test 3 — 15 Questions

Question 1

A company is deploying a hybrid cloud solution using Partner Interconnect. They have ordered a 1 Gbps connection from a partner at a colocation facility. The on-premises network uses a 10 Gbps link to the colo, and the partner provides a single 1 Gbps connection to Google Cloud. The company wants to connect two separate VPC networks in Google Cloud (production and development) to their on-premises network. Each VPC requires 500 Mbps of dedicated bandwidth. The company also needs high availability for the connection. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create two VLAN attachments on the same interconnect, each with 500 Mbps capacity. Configure a separate Cloud Router for each VPC, each with a BGP session on its respective VLAN attachment. Use BGP metrics for active/passive failover.. Partner Interconnect supports multiple VLAN attachments on a single connection, each with its own capacity allocation. By creating two VLAN attachments with 500 Mbps each, you can dedicate bandwidth to each VPC while meeting the 500 Mbps requirement. Using separate Cloud Routers with BGP sessions on each VLAN attachment and adjusting BGP metrics (e.g., local preference) allows active/passive failover for high availability, satisfying both the bandwidth and HA needs without requiring additional physical connections.

Answer

Create a single VLAN attachment, then use a shared VPC with two subnets. Configure one Cloud Router with two BGP sessions, one for each subnet.

Answer

Create one VLAN attachment with 1 Gbps capacity, attach it to both VPCs using a single Cloud Router with two BGP sessions.

Answer

Order two separate 1 Gbps Partner Interconnect connections, one for each VPC, and configure each with a single VLAN attachment.

Question 2

Drag and drop the steps to configure Cloud Router with BGP for on-premises connectivity into the correct order.

Accepted Answer

1. Create a Cloud Router, 2. Create a VPN tunnel, 3. Configure BGP session, 4. Configure custom route advertisements, 5. Verify connectivity. Cloud Router requires a router first, then a tunnel, followed by BGP configuration. Custom advertisements and verification complete the setup.

Answer

1. Create a VPN tunnel, 2. Create a Cloud Router, 3. Configure BGP session, 4. Configure custom route advertisements, 5. Verify connectivity

Answer

1. Create a Cloud Router, 2. Configure BGP session, 3. Create a VPN tunnel, 4. Configure custom route advertisements, 5. Verify connectivity

Answer

1. Create a Cloud Router, 2. Create a VPN tunnel, 3. Configure custom route advertisements, 4. Configure BGP session, 5. Verify connectivity

Question 3

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

Accepted Answer

Check VPN tunnel status, then Verify BGP session status, then Check firewall rules, then Verify routing tables, then Perform connectivity tests. Troubleshooting starts with tunnel status, then BGP, firewall, routing, and finally connectivity tests.

Answer

Verify routing tables, then Check firewall rules, then Check VPN tunnel status, then Verify BGP session status, then Perform connectivity tests

Answer

Verify BGP session status, then Check VPN tunnel status, then Check firewall rules, then Verify routing tables, then Perform connectivity tests

Answer

Perform connectivity tests, then Check VPN tunnel status, then Verify BGP session status, then Check firewall rules, then Verify routing tables

Question 4

Drag and drop the steps to configure a global external HTTP(S) load balancer in Google Cloud into the correct order.

Accepted Answer

Create backend service, then health check, then URL map, then target proxy, then forwarding rule.. Load balancer setup: backend, health check, URL map, target proxy, forwarding rule.

Answer

Create health check, then backend service, then URL map, then target proxy, then forwarding rule.

Answer

Create backend service, then URL map, then health check, then target proxy, then forwarding rule.

Answer

Create backend service, then health check, then target proxy, then URL map, then forwarding rule.

Question 5

Match each VPC firewall rule component to its description.

Accepted Answer

Source: The IP address or range from which traffic originates.. Correct matches: Source refers to originating IPs, Destination to target IPs, Action to allow/deny, Direction to ingress/egress. Priority and Protocol are other components with distinct meanings.

Answer

Priority: The IP address range from which traffic originates.

Answer

Protocol: Whether the rule allows or denies traffic.

Question 6

Match each VPC networking concept to its definition.

Accepted Answer

VPC: A global virtual network that spans all regions.. VPC is global, subnets are regional. Firewall rules filter traffic, routes determine paths. Common confusions: swapping global/regional or filtering/routing.

Answer

Subnet: A global resource used for IP address management.

Answer

Routes: A set of rules that control traffic based on source and destination.

Question 7

Match each Google Cloud Armor feature to its description.

Accepted Answer

Security Policies: A set of rules that filter traffic to backend services based on conditions.. Cloud Armor features include Security Policies (rule-based traffic filtering), WAF Rules (web vulnerability protection), and DDoS Protection (edge mitigation). Common confusions mix WAF with IP lists or rate limiting.

Answer

Security Policies: A feature that provides managed protection against OWASP Top 10 attacks.

Answer

WAF Rules: A list of allowed or blocked IP addresses for backend services.

Answer

DDoS Protection: Enables custom rate limiting for individual users.

Question 8

A company needs to connect their on-premises data center to Google Cloud with a consistent, high-availability connection that offers 99.99% availability SLA. The on-premises router supports VLAN tagging and BGP. They expect to burst up to 50 Gbps peak traffic. Which interconnect solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, supporting up to 80 Gbps per connection (via 10 or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant links and BGP sessions. The on-premises router's support for VLAN tagging and BGP aligns perfectly with Dedicated Interconnect's requirements for 802.1Q VLANs and eBGP peering, making it the only option that meets the 50 Gbps burst requirement and high-availability SLA.

Answer

Cloud VPN with dynamic routing

Answer

Partner Interconnect

Answer

HA VPN

Question 9

A network engineer has configured a Dedicated Interconnect with a VLAN attachment and Cloud Router. BGP sessions are up and routes are exchanged. However, traffic from a specific on-premises subnet is not reaching a VPC instance. The route table shows a custom static route with priority 1000 for that subnet pointing to a VPN tunnel, and a BGP learned route with priority 100 for the same subnet via Interconnect. What is the most likely reason for the traffic not using the Interconnect route?

Accepted Answer

The BGP route's next hop is not reachable due to a missing firewall rule on the on-premises side. The BGP route with priority 100 is preferred over the static route with priority 1000. However, if the BGP route's next hop is not reachable (e.g., due to a missing firewall rule on the on-premises side blocking the necessary ICMP or BGP session traffic), the route will be considered invalid and not installed in the routing table. This causes traffic to fall back to the less preferred static route via the VPN tunnel, explaining why the Interconnect path is not used.

Answer

Route propagation is disabled on the Cloud Router

Answer

VPC firewall rules are blocking traffic on the Interconnect VLAN attachment

Answer

The BGP route has a lower MED than the static route

Question 10

You are designing a hybrid network using Cloud VPN with dynamic routing (BGP) to connect multiple on-premises sites to Google Cloud. What is a best practice to avoid asymmetric routing when you have multiple VPN tunnels from different on-premises routers?

Accepted Answer

Configure all on-premises routers with the same BGP ASN and enable ECMP on the Cloud Router. Using the same BGP ASN on all on-premises routers and enabling ECMP on the Cloud Router allows the Cloud Router to treat multiple BGP sessions as equal-cost paths. This prevents asymmetric routing by ensuring that return traffic can be load-balanced across any available tunnel, while the same ASN avoids BGP loop-prevention mechanisms that would otherwise reject routes from routers with different ASNs.

Answer

Use static routes instead of BGP to have precise control over path selection

Answer

Use a different BGP ASN for each on-premises router to ensure uniqueness

Answer

Disable ECMP on the Cloud Router to avoid multipath issues

Question 11

An organization needs low-latency connectivity between their on-premises data center and Google Cloud, supporting up to 20 Gbps throughput. They already have a Partner Interconnect connection but need to increase capacity. Which two actions should they take? (Choose two.)

Accepted Answer

Work with the service provider to upgrade the existing interconnect to a higher capacity. Partner Interconnect connections can be upgraded to higher capacity by working with the service provider, as the provider manages the underlying physical circuit. This allows increasing throughput up to 20 Gbps without replacing the existing connection, leveraging the existing Layer 2 or Layer 3 handoff.

Answer

Create additional Cloud VPN tunnels to the same region

Answer

Provision a new Dedicated Interconnect to bypass the partner

Question 12

Your company has a Dedicated Interconnect between on-premises and Google Cloud. After a maintenance window, some routes are missing from the on-premises side. On the Cloud Router, you see that the BGP session status is 'ESTABLISHED'. However, the route table on the on-premises router does not contain any of the VPC subnets. What is the most likely cause?

Accepted Answer

The Cloud Router has an empty 'Advertised IP ranges' list. The BGP session is 'ESTABLISHED', confirming that the TCP connection and BGP peering are working correctly. However, the on-premises router is not receiving any VPC subnet routes because the Cloud Router's 'Advertised IP ranges' list is empty, meaning it is not advertising any routes to the peer. This is a common misconfiguration where the Cloud Router is configured to use custom route advertisements but the list of prefixes to advertise is left blank.

Answer

The Cloud Router is not configured to advertise any custom routes

Answer

MD5 authentication is enabled but passwords differ

Answer

BGP configuration mismatch on the on-premises router

Question 13

You are troubleshooting an HA VPN connection between Google Cloud and on-premises. The tunnels appear as 'UP' but no routes are exchanged. The Cloud Router logs show 'BGP session state: IDLE'. What is the most likely cause?

Accepted Answer

BGP is not enabled on the Cloud Router. B is correct because the BGP session state IDLE indicates that BGP is not configured or enabled on the Cloud Router. Even though the IPsec tunnels are UP, no BGP routes can be exchanged if the BGP process itself is not running. In Google Cloud, you must explicitly enable BGP on the Cloud Router for each VPN tunnel; otherwise, the BGP session cannot transition from IDLE to any other state.

Answer

The BGP keepalive timer is set too high on the on-premises router

Answer

Firewall rules are blocking UDP port 179

Answer

The on-premises BGP peer is configured with a different next-hop IP

Question 14

A company uses a shared VPC with multiple service projects. They want to connect their on-premises data center to the shared VPC through a Dedicated Interconnect. Where should they configure the Cloud Router and VLAN attachment?

Accepted Answer

In the host project of the shared VPC. In a shared VPC architecture, the Cloud Router and VLAN attachment for Dedicated Interconnect must be configured in the host project because the host project owns the VPC network and manages all network resources, including interconnect attachments. Service projects consume subnets from the host project but cannot create or manage interconnect resources. This ensures that the on-premises connectivity is centrally managed and that all service projects can use the interconnect through the shared VPC's routing.

Answer

In the same region as the majority of service project instances

Answer

In a global resource policy, cross-project

Answer

In the service project that will use the connectivity

Question 15

You have set up a Dedicated Interconnect with two VLAN attachments (each 10 Gbps) and configured ECMP on the Cloud Router. You observe that traffic from on-premises to a specific VM is only using one attachment. What is the most likely cause?

Accepted Answer

The traffic consists of a single flow that is hashed to one attachment. D is correct because ECMP (Equal-Cost Multi-Path) relies on hashing of packet headers (e.g., 5-tuple: source/destination IP, protocol, source/destination port) to select a path. A single flow (e.g., a TCP connection between two specific IPs and ports) will always hash to the same attachment, so it cannot use both VLAN attachments simultaneously. This is expected behavior, not a fault.

Answer

Route propagation is disabled on one Cloud Router interface

Answer

One of the VLAN attachments has a higher route priority

Answer

BGP ASN mismatch between the two attachments