PCNE Implementing Hybrid Interconnectivity Practice Test 4 — 15 Questions

Question 1

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides a direct, private connection between your on-premises network and Google Cloud, supporting bandwidth up to 100 Gbps (via multiple 10 Gbps or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant attachments. This solution requires you to manage your own physical infrastructure in a Google colocation facility, meeting the organization's requirement for self-managed hardware.

Answer

Cloud VPN with multiple tunnels

Answer

Partner Interconnect

Answer

HA VPN

Question 2

Which TWO of the following are required steps to set up a Dedicated Interconnect?

Accepted Answer

Create an interconnect (physical connection) in the colocation facility. Creating an interconnect (physical connection) in the colocation facility is a required step because Dedicated Interconnect requires a direct, physical cross-connect between your on-premises router and a Google Cloud edge router at a colocation facility. This physical link is the foundation of the dedicated, high-bandwidth connection, and without it, no Layer 2 or Layer 3 connectivity can be established.

Answer

Establish a VPN tunnel as a backup

Answer

Deploy a Google-provided router in the colocation facility

Answer

Configure MD5 authentication on the BGP session

Question 3

Which TWO of the following could cause a Dedicated Interconnect BGP session to go to the 'IDLE' state?

Accepted Answer

BGP is not enabled on the Cloud Router. BGP uses TCP port 179, not UDP. Blocking UDP port 179 has no effect on BGP session establishment. Options B and E are correct: BGP must be enabled on the Cloud Router, and the Cloud Router must be configured with the on-premises peer IP and ASN; otherwise, the session remains in IDLE state. Options C and D are incorrect: keepalive timer mismatch can cause hold timer expiry but does not prevent session establishment, and MED mismatch affects path selection, not session state.

Answer

Firewall rules blocking UDP port 179

Answer

BGP keepalive timer mismatch

Answer

Multi-Exit Discriminator (MED) mismatch

Question 4

Which TWO situations are most appropriate for using Partner Interconnect instead of Dedicated Interconnect?

Accepted Answer

When data center space is limited and you cannot host a Google edge router. Partner Interconnect is ideal when you lack direct colocation space (Option C) because it uses a service provider's facility to connect to Google. It is also appropriate when you want to leverage an existing service provider connection (Option E), as the partner already has a presence in a Google Cloud edge location. In contrast, Dedicated Interconnect requires direct colocation and provides higher bandwidth and SLA, making it unsuitable for these scenarios.

Answer

When you need IPSec encryption

Answer

When 99.99% SLA is required

Answer

When bandwidth requirements exceed 10 Gbps per connection

Question 5

A company has a Dedicated Interconnect with one 10 Gbps connection. They need high availability for critical workloads. Which design is the best practice according to Google Cloud recommendations?

Accepted Answer

Provision a second Dedicated Interconnect connection to a different PoP.. Google Cloud best practice for high availability with Dedicated Interconnect requires at least two physical connections, each to a different edge point of presence (PoP), to eliminate single points of failure at the network edge. A single 10 Gbps connection, even with a backup VPN, does not provide the same SLA or bandwidth guarantees for critical workloads. Option A ensures that if one PoP or provider fails, the other connection can maintain connectivity.

Answer

Add a second connection to the same PoP using the same provider.

Answer

Rely on the single connection and monitor for failures.

Answer

Use Cloud VPN as a backup to the Dedicated Interconnect.

Question 6

A network engineer is configuring a Cloud VPN tunnel with route-based VPN and BGP. The tunnel is established, but the Cloud Router does not learn any routes from the on-premises peer. What is the most likely cause?

Accepted Answer

The BGP session is not configured on the VPN tunnel.. The most likely cause because the BGP session must be explicitly configured on the VPN tunnel interface for route exchange. Option A is incorrect because BGP uses TCP port 179, not UDP. Option D is incorrect because a Cloud Router without an ASN would not establish a BGP session, but this is not a given in the scenario; however, the question asks for the most likely cause, and the tunnel being established suggests the VPN is up, but BGP configuration is missing. Option C is incorrect because not all options are possible causes (A and D are not valid).

Answer

Firewall rules on the on-prem router block UDP port 179.

Answer

All of the above are possible causes.

Answer

The Cloud Router does not have an ASN configured.

Question 7

A company with multiple VPCs in a Shared VPC environment wants to connect their on-premises network to all VPCs with high availability and minimal cost. They already have a Dedicated Interconnect. What is the most efficient solution?

Accepted Answer

Use the existing Dedicated Interconnect to create multiple VLAN attachments, one per VPC.. A Dedicated Interconnect can support multiple VLAN attachments (each with a separate VLAN ID and BGP session) to connect to different VPCs in a Shared VPC environment. This approach leverages the existing physical connection, provides high availability through redundant attachments, and minimizes cost by avoiding additional circuits or VPN tunnels.

Answer

Set up Cloud VPN with dynamic routing to each VPC.

Answer

Create an HA VPN gateway for each VPC and peer with on-prem.

Answer

Provision a new Partner Interconnect for each VPC.

Question 8

An on-premises router uses BGP ASN 64512. The Cloud Router is also configured with ASN 64512. When the BGP peering is established, what behavior is expected?

Accepted Answer

The BGP session will fail or behave unpredictably.. BGP requires each router in a peering session to have a unique ASN to properly enforce loop prevention and path selection. When both the on-premises router and Cloud Router use the same ASN 64512, the BGP session will fail or behave unpredictably because each router will see its own ASN in received updates, triggering the BGP loop detection mechanism (RFC 4271, Section 9.3) and causing the session to drop or routes to be rejected.

Answer

The session works but routes are not exchanged.

Answer

Cloud Router will automatically prepend its ASN to avoid conflict.

Answer

The BGP session works normally since ASN 64512 is a private ASN.

Question 9

Which Google Cloud hybrid connectivity option can be configured without using BGP?

Accepted Answer

Classic VPN with static routes. Classic VPN can be configured with static routes and does not require BGP. Partner Interconnect and Dedicated Interconnect require BGP for routing. HA VPN also typically uses BGP for dynamic routing, making D the only option that can operate without BGP.

Answer

Partner Interconnect

Answer

Dedicated Interconnect

Answer

HA VPN

Question 10

A company is using Partner Interconnect to connect to Google Cloud. They notice that traffic from on-premises to GCP takes one path, but return traffic takes a different path, causing asymmetric routing. How can they resolve this?

Accepted Answer

Apply BGP MED values to influence path selection.. B is correct because applying BGP MED (Multi-Exit Discriminator) values allows you to influence the path selection for return traffic from Google Cloud to your on-premises network. By setting a lower MED value on one of the Partner Interconnect connections, you can make Google Cloud prefer that path for return traffic, thereby matching the forward path and resolving asymmetric routing. This is a standard BGP technique for controlling inbound traffic to an AS.

Answer

Configure the same BGP ASN on both sides.

Answer

Enable asymmetric routing mode on the Cloud Router.

Answer

Use different link-local addresses for each session.

Question 11

A Dedicated Interconnect VLAN attachment is in ACTIVE state. The Cloud Router has learned routes from on-premises, and the on-premises router has learned routes from GCP. However, traffic from on-premises to a GCP VM fails. What should the engineer check first?

Accepted Answer

Both A and C.. Both firewall rules and VPC subnet routes must be in place for traffic to reach a GCP VM. Even if the VLAN attachment is ACTIVE and routes are exchanged, the VPC firewall must permit ingress from the on-premises range, and the VPC subnet routes must exist in the routing table for the VM's subnet. Without both, traffic will be dropped or not forwarded.

Answer

Check firewall rules on the GCP VPC for ingress from the on-premises range.

Answer

Confirm that the Cloud Router is advertising the on-premises subnets back to the VPC.

Answer

Verify that the VPC subnet routes exist in the routing table.

Question 12

What is the maximum number of VLAN attachments that can be configured on a single 10 Gbps Dedicated Interconnect connection?

Accepted Answer

8. A single 10 Gbps Dedicated Interconnect connection supports a maximum of 8 VLAN attachments. This limit is defined by Google Cloud's interconnect architecture, where each VLAN attachment consumes a portion of the 10 Gbps bandwidth and is mapped to a unique VLAN ID. The 8-attachment cap ensures predictable performance and avoids oversubscription on the physical link.

Answer

16

Answer

4

Answer

2

Question 13

A customer is configuring a route-based IPsec VPN tunnel to Google Cloud. On their on-premises router, they must specify traffic selectors (proxy IDs). What should they set the local and remote traffic selectors to?

Accepted Answer

Set both local and remote traffic selectors to 0.0.0.0/0.. For route-based VPN, traffic selectors (proxy IDs) should be set to 0.0.0.0/0 (any) because route-based tunnels use routing tables to determine which traffic is sent through the tunnel, rather than policy-based selectors. Option A is incorrect because IKE version does not affect traffic selectors. Option B is incorrect because specifying local and remote subnets is used for policy-based VPN, not route-based. Option C is incorrect because the question specifies route-based VPN; using policy-based VPN is unnecessary and not the correct action.

Answer

Configure IKE version to match.

Answer

Set local to on-prem subnet and remote to VPC subnet.

Answer

Use policy-based VPN instead.

Question 14

Which TWO configurations provide high availability for Dedicated Interconnect? (Choose two.)

Accepted Answer

Two connections to different PoPs.. Connecting to two different Points of Presence (PoPs) provides geographic redundancy; if one PoP fails, traffic can be rerouted through the other. Option E is correct because two connections to the same PoP provide link-level redundancy; if one circuit fails, the other can continue carrying traffic, and BGP can be used to load-balance or failover between them.

Answer

A single circuit with L2 redundancy.

Answer

Using Cloud NAT for failover.

Answer

A single connection from one provider.

Question 15

Which THREE factors can affect the throughput of a Cloud VPN tunnel? (Choose three.)

Accepted Answer

Tunnel type (route-based vs policy-based). Tunnel type (route-based vs policy-based) affects throughput because route-based tunnels (e.g., using BGP or static routes) can leverage ECMP and do not require per-flow policy lookups, reducing CPU overhead. Policy-based tunnels require the VPN gateway to evaluate each packet against a security policy, which adds latency and can limit throughput, especially under high traffic loads.

Answer

VM instance types

Answer

Number of tunnels