PCNE Implementing Hybrid Interconnectivity Practice Test 4 — 15 Questions

Question 1

A company wants to establish a dedicated physical connection between their on-premises network and Google Cloud. They need a 10 Gbps connection and are willing to manage the circuit and colocation facility themselves. Which Google Cloud service should they use?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct physical connection between the on-premises network and Google's network via a colocation facility and Google Partner PoP. It is managed by the customer for circuit ordering and colocation.

Answer

Partner Interconnect

Answer

Cloud CDN

Answer

Cloud VPN

Question 2

An engineer has set up a Dedicated Interconnect with a VLAN attachment and a Cloud Router BGP session. They can ping the on-premises gateway IP but cannot reach an on-premises subnet 10.0.0.0/24 from a GCE instance. The on-premises router is advertising the subnet via BGP. What is the most likely cause?

Accepted Answer

The GCE instance does not have a route to the on-premises subnet. The GCE instance can ping the on-premises gateway IP because the Cloud Router has a BGP session and the gateway IP is directly reachable via the VLAN attachment. However, to reach the on-premises subnet 10.0.0.0/24, the GCE VPC needs a route for that subnet pointing to the Cloud Router as the next hop. Without an automatically propagated or manually configured route in the VPC, traffic from the GCE instance to 10.0.0.0/24 will be dropped, even though the on-premises router is advertising the subnet via BGP.

Answer

The VLAN attachment is in the wrong region

Answer

The on-premises firewall is blocking ICMP

Answer

The on-premises router is not using the correct BGP AS number

Question 3

An enterprise requires a hybrid connectivity solution that meets a 99.99% SLA. They plan to use Dedicated Interconnect. Which configuration satisfies the SLA requirement?

Accepted Answer

Two Dedicated Interconnect connections in different metro areas with active-active configuration. Google's 99.99% SLA for Dedicated Interconnect requires two connections, each from a different metro area, configured for active-active or active-passive.

Answer

Two Partner Interconnect connections from different providers in the same metro area

Answer

Two Dedicated Interconnect connections in the same metro area with active-passive configuration

Answer

Single Dedicated Interconnect connection with two VLAN attachments

Question 4

A company uses High Availability VPN (HA VPN) with two tunnels and BGP to connect to an on-premises network. They notice traffic only flows through one tunnel. They want to ensure both tunnels are used simultaneously. What should they do?

Accepted Answer

Enable equal-cost multipath (ECMP) on the Cloud Router. To use both tunnels simultaneously, ECMP must be enabled in the VPC. By default, HA VPN with BGP uses active-passive if the on-premises router uses a lower local preference for one path. ECMP can be enabled on the Cloud Router.

Answer

Increase the MED value on the active tunnel to make it less preferred

Answer

Configure both tunnels with the same BGP AS number on the on-premises side

Answer

Configure static routes with equal cost for both tunnels

Question 5

A company wants to resolve on-premises DNS names from Google Cloud VMs. They have a Cloud DNS private zone for their domain and on-premises DNS servers at IP 10.1.1.1 and 10.1.1.2. Which Cloud DNS feature should they use?

Accepted Answer

Outbound DNS forwarding using an outbound forwarding zone. DNS forwarding zones allow Cloud DNS to forward queries for a specific domain to on-premises DNS servers.

Answer

Inbound DNS policy

Answer

Peering zones

Answer

Managed reverse lookup zones

Question 6

A company is using Partner Interconnect with a service provider that offers Layer 3 connectivity. The service provider manages the BGP sessions. The engineer needs to create a VLAN attachment on the Google side. Which attachment type should they choose?

Accepted Answer

PARTNER_PROVIDER. For Partner Interconnect, when the service provider manages Layer 3 (BGP), the VLAN attachment type must be PARTNER_PROVIDER. The PARTNER type is for Layer 2 connectivity where the customer manages BGP.

Answer

PARTNER

Answer

MANAGED

Answer

DEDICATED

Question 7

An engineer configures an HA VPN with two tunnels to an on-premises network using IKEv2 and pre-shared keys. After configuration, the tunnels show as established, but no traffic flows. The Cloud Router BGP sessions are not established. The on-premises firewall logs show IKE packets are being sent but no response. What is the most likely cause?

Accepted Answer

The pre-shared keys do not match. B is correct because the on-premises firewall logs show IKE packets being sent but no response, which indicates that the IKEv2 pre-shared key mismatch causes the IKE authentication phase to fail. Even though the tunnel status shows as established (likely due to a stale or misconfigured status check), the BGP sessions cannot form because the IKE security association (SA) is not fully authenticated, preventing the IPsec SA from being created and thus blocking all traffic, including BGP packets.

Answer

The Cloud Router BGP AS number is duplicated

Answer

The on-premises firewall is blocking UDP port 500

Answer

The VPN tunnel is configured as policy-based instead of route-based

Question 8

An organization has two Dedicated Interconnect connections in an active-passive configuration. They want to make the passive connection active for maintenance. What should they do to fail over traffic?

Accepted Answer

Configure as-path prepending on the active Cloud Router BGP session to make it less preferred. To fail over traffic, the engineer can use as-path prepending on the active connection to make it less preferred, or adjust MED, or use local preference on the on-premises side. The question implies a GCP-side action: using as-path prepending via Cloud Router BGP configuration.

Answer

Shut down the Cloud Router on the active connection

Answer

Set the MED metric to 0 on the active connection

Answer

Delete the VLAN attachment on the active connection

Question 9

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

Accepted Answer

interconnect/link/operational_status. The metric 'interconnect/link/operational_status' provides the operational status of each interconnect link (e.g., operational, degraded).

Answer

interconnect/vlan_attachment/outbound_bytes

Answer

interconnect/network/packet_drop_count

Answer

interconnect/network/received_bytes_count

Question 10

An engineer is configuring a Cloud Router for HA VPN. They need to enable BGP on the VPN tunnels. Which BGP configuration is required for the Cloud Router to advertise the VPC subnets to the on-premises network?

Accepted Answer

Create a custom route advertisement for each subnet. Option C is correct because Cloud Router uses Border Gateway Protocol (BGP) to dynamically exchange routes with the on-premises network over HA VPN tunnels. By default, Cloud Router advertises only the VPC subnet ranges that are directly connected to the VPC network. To ensure all VPC subnets are advertised, you must create custom route advertisements for each subnet that needs to be reachable from on-premises. This is done by configuring the Cloud Router with a custom advertisement mode and specifying the subnet CIDR ranges as custom advertised IP ranges.

Answer

Set up a VPC peering connection

Answer

Use static routes on the VPN tunnel

Answer

Configure the VPN gateway to advertise the subnets

Question 11

A company has a Partner Interconnect connection (Layer 2) with a service provider. They need to configure BGP sessions on their on-premises router and Google Cloud Router. The engineer creates a VLAN attachment of type PARTNER. However, the BGP session does not come up. What is the most likely reason?

Accepted Answer

The Cloud Router BGP IP address is not in the same subnet as the VLAN attachment. In Layer 2 Partner Interconnect, the customer must configure BGP sessions. The VLAN attachment type PARTNER requires the customer to manage BGP. Common issues include incorrect VLAN ID or IP addresses.

Answer

The VLAN attachment type should be PARTNER_PROVIDER

Answer

The IAM permissions for the Cloud Router are missing

Answer

The on-premises router is using a different BGP AS number than configured

Question 12

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

Accepted Answer

Inbound DNS policy. Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Answer

DNS peering

Answer

Outbound DNS forwarding zone

Answer

Private zone with DNS forwarding

Question 13

A company is designing a highly available hybrid network using HA VPN. They need to ensure that if one VPN tunnel fails, traffic automatically fails over to the other tunnel. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable BGP on both tunnels. HA VPN requires two tunnels from two interfaces, each with its own external IP, and BGP sessions on both tunnels. The on-premises side must also have two separate peer IPs.

Answer

Configure static routes for failover

Answer

Configure both tunnels with the same peer IP address on the on-premises side

Answer

Use the same pre-shared key for both tunnels

Question 14

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Accepted Answer

Mismatched BGP hold timer values. BGP session flapping can be caused by mismatched parameters, MTU issues, or authentication problems.

Answer

Incorrect VLAN ID on the VLAN attachment

Answer

Duplicate AS number on the on-premises router

Question 15

An organization is considering using Partner Interconnect to connect to Google Cloud. They want the service provider to manage the BGP sessions. Which TWO configurations must they choose? (Choose TWO.)

Accepted Answer

Create VLAN attachment of type PARTNER_PROVIDER. For Layer 3 connectivity where the provider manages BGP, the VLAN attachment type must be PARTNER_PROVIDER, and the provider handles BGP.

Answer

Select Layer 2 connectivity option with the provider

Answer

Create VLAN attachment of type PARTNER

Answer

Configure BGP sessions on the Cloud Router