PCNE Implementing Hybrid Interconnectivity Practice Test 4 — 15 Questions

Question 1

A company has two HA VPN tunnels from on-premises to Google Cloud using two separate Cloud Routers for redundancy. The on-premises network uses BGP and advertises a default route to Google Cloud. The company wants to ensure that traffic from Google Cloud to on-premises prefers the primary Cloud Router over the secondary. Which configuration should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a higher LOCAL_PREF on the primary Cloud Router for the default route.. LOCAL_PREF is a well-known mandatory BGP attribute that is used to influence outbound traffic from an AS. By setting a higher LOCAL_PREF on the primary Cloud Router for the default route, Google Cloud will prefer that path for traffic destined to on-premises, as LOCAL_PREF is evaluated before other attributes like AS_PATH and MED.

Answer

Set the primary Cloud Router's BGP IP as the next-hop for all routes on the secondary.

Answer

Set a lower MED on the primary Cloud Router's BGP session for the default route advertisement.

Answer

Set a shorter AS_PATH on the primary Cloud Router's BGP session.

Question 2

Which three of the following are best practices for designing a highly available Dedicated Interconnect connection to Google Cloud? (Choose three.)

Accepted Answer

Ensure that the on-premises routers are in different failure zones.. Option B is correct because placing the on-premises routers in different failure zones (distinct administrative/power/network domains) ensures that a single local failure cannot take down both Interconnect links, which is essential for end-to-end high availability. Option D is correct because using VLAN attachments in different regions provides geographic redundancy, so an outage affecting one Google Cloud region or metro does not disrupt all connectivity. Option E is correct because deploying two physical connections to different Google edge availability domains (for example, two different metros or two distinct edge sites) protects against a single edge location or fiber-path failure, which is the core of a highly available Dedicated Interconnect design. Option A is not a best practice because a single Cloud Router is a regional resource and a single point of failure; Google recommends redundant Cloud Routers in different regions for HA. Option C is not a best practice because each interconnect attachment should use its own separate BGP session (with distinct VLAN attachments and Cloud Routers), and sharing one BGP session would create a single point of failure and prevent proper failover.

Answer

Use a single Cloud Router for both interconnect attachments.

Answer

Configure both connections to use the same BGP session.

Question 3

An enterprise is evaluating connectivity options to Google Cloud. They have moderate bandwidth requirements (up to 1 Gbps) and need high availability. Which two of the following are appropriate solutions? (Choose two.)

Accepted Answer

HA VPN over the internet.. Option A (HA VPN over the internet) is correct because Cloud HA VPN provides a 99.99% SLA by using two or more tunnels across two interfaces, and it easily supports up to 1 Gbps per tunnel over the public internet, matching the moderate bandwidth and high availability needs. Option C (Partner Interconnect with 1 Gbps connection) is correct because Partner Interconnect is designed for exactly this bandwidth range (50 Mbps to 50 Gbps via service providers) and can be provisioned with redundant connections to meet high availability. Option B is not appropriate because VPC peering is a Google Cloud-internal networking feature and does not provide connectivity to a third-party/on-premises network. Option D is not appropriate because Classic VPN with a single tunnel offers no redundancy and thus fails the high availability requirement. Option E is not appropriate because Dedicated Interconnect requires 10 Gbps or 100 Gbps circuits, exceeding the stated moderate bandwidth requirement and cost profile.

Answer

VPC peering with a third-party network.

Answer

Classic VPN with a single tunnel.

Answer

Dedicated Interconnect with 10 Gbps connections.

Question 4

Refer to the exhibit. The Cloud Router is connected to two on-premises routers via dedicated interconnect. The on-premises routers advertise the same prefix 10.1.0.0/16. Which on-premises router's route will be preferred by Google Cloud for traffic destined to 10.1.0.0/24? (Assume equal AS path length and MED from on-premises.)

Accepted Answer

The route from peer with IP 169.254.1.1. Google Cloud Router uses the customLearnedRoutePriority attribute as a tiebreaker when two on-premises routers advertise the same prefix via separate VLAN attachments on Dedicated Interconnect, assuming equal AS path length and MED. The router with the lower customLearnedRoutePriority value is preferred. In this scenario, the peer 169.254.1.1 has a lower priority (e.g., 100) compared to 169.254.0.1's higher priority (e.g., 200). Therefore, the route from peer 169.254.1.1 is selected.

Answer

The route with lower peer IP address

Answer

Both routes will be used equally (ECMP)

Answer

The route from peer with IP 169.254.0.1

Question 5

Refer to the exhibit. An engineer has configured HA VPN with two tunnels (tunnel-a and tunnel-b) to an on-premises network. The BGP session for peer-b is in IDLE state. What is the most likely cause?

Accepted Answer

The on-premises router's BGP configuration for peer-b has a wrong IP address.. The BGP session for peer-b is in IDLE state, which typically indicates a TCP connection failure. Since tunnel-a is working, the Cloud Router and VPN gateway are correctly configured, and the issue is specific to peer-b. The most likely cause is that the on-premises router's BGP configuration for peer-b has the wrong IP address (e.g., the wrong BGP peer IP or the wrong Cloud Router interface IP), preventing the TCP handshake from completing.

Answer

The Cloud Router is not in the same region as the VPN gateway.

Answer

The on-premises router is not advertising any routes.

Answer

The pre-shared key for tunnel-b is incorrect.

Question 6

Refer to the exhibit. A network engineer configured a Cloud Router to advertise the on-premises subnet 10.0.0.0/8 to the VPC. However, traffic from VPC instances to 10.0.0.0/8 is being dropped. What is the most likely issue?

Accepted Answer

The subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range.. Cloud Router uses custom route advertisements, and if the on-premises subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range (e.g., the default or custom subnet ranges within the VPC), Google Cloud will not install or will drop traffic for that route due to a conflict. Overlapping routes cause the VPC to prefer its own local routes, resulting in dropped traffic to the on-premises subnet.

Answer

The advertised route has a priority that is too low.

Answer

The Cloud Router's ASN is private, causing routes to be rejected.

Answer

The on-premises router is not configured to accept the advertised route.

Question 7

A company is deploying a Global Cloud VPN with multiple tunnels from different Cloud Router instances to the same on-premises peer. The on-premises BGP speaker is configured with multiple peers. How should they configure the BGP ASN on the Cloud Routers to ensure optimal routing?

Accepted Answer

Use the same private ASN for all Cloud Routers in the same region.. Using the same private ASN on all Cloud Routers in the same region allows the on-premises BGP speaker to treat multiple tunnels from that region as a single BGP session, enabling load balancing and failover without creating BGP path selection issues. This approach aligns with Google Cloud's recommendation for redundant VPN tunnels, where the same ASN ensures the on-premises router sees the Cloud Routers as a single BGP peer, simplifying routing policy and avoiding unnecessary AS path prepending.

Answer

Use different private ASNs for each Cloud Router to differentiate the tunnels.

Answer

Assign a unique public ASN to each Cloud Router.

Answer

Use the same ASN across all Cloud Routers globally.

Question 8

Refer to the exhibit. A Cloud VPN tunnel is configured between an on-premises router and Google Cloud. The BGP session is not established. The on-premises router shows 'Connection refused'. What is the most likely cause?

Accepted Answer

The Cloud Router is not configured to accept BGP connections from this on-premises peer.. The 'Connection refused' error on the on-premises router indicates that the Cloud Router is actively rejecting the TCP connection attempt for the BGP session. This typically occurs when the Cloud Router does not have a BGP peer configured with the on-premises router's IP address, or the peer is in an 'inactive' state. Since the Cloud VPN tunnel itself can be established (option A is not necessarily true), the most likely cause is that the Cloud Router is not configured to accept BGP connections from this specific on-premises peer.

Answer

The Cloud VPN tunnel is not established.

Answer

The on-premises router's BGP configuration has the wrong ASN.

Answer

The BGP MD5 password is mismatched between the two peers.

Question 9

A company wants to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have ordered a 10 Gbps connection and plan to use a single VLAN attachment. How many Cloud Router interfaces are required for a single VLAN attachment with active/active BGP?

Accepted Answer

1 interface. For a single VLAN attachment using Dedicated Interconnect with active/active BGP, only one Cloud Router interface is required. The Cloud Router interface represents the VLAN attachment itself, and BGP sessions are configured as sub-interfaces under that single interface. Active/active BGP does not require multiple interfaces; it uses two BGP sessions (one for each router in the pair) but both sessions share the same VLAN attachment and Cloud Router interface.

Answer

4 interfaces (two for each BGP session)

Answer

2 interfaces (one for each VLAN)

Answer

2 interfaces (one for each BGP session)

Question 10

A network engineer is troubleshooting an HA VPN setup between Google Cloud and an on-premises data center. The two tunnels are established, and BGP sessions are up on both tunnels. However, traffic from Google Cloud to the on-premises network is only using one tunnel, even though both BGP sessions are advertising the same routes. What is the most likely cause?

Accepted Answer

The on-premises router is sending different BGP metrics (MED) for the same route on the two BGP sessions.. When both BGP sessions are up and advertising the same routes, but traffic only uses one tunnel, the most likely cause is that the on-premises router is sending different Multi-Exit Discriminator (MED) values for the same route on the two BGP sessions. MED is a metric that influences inbound traffic to an AS; a lower MED value is preferred. If one tunnel's BGP update carries a lower MED, Google Cloud's Cloud Router will select that path for all traffic, even though both tunnels are functional.

Answer

The Cloud Router is not configured for dynamic routing.

Answer

One of the IPsec tunnels is in a dead state.

Answer

The on-premises router is setting a higher local preference on one route.

Question 11

A company is using Partner Interconnect to connect their data center to Google Cloud. They notice that traffic from their on-premises network to a specific subnet in VPC is taking a suboptimal path. Which action should they take to influence the routing preference?

Accepted Answer

Configure BGP MED values on the on-premises router for the prefixes advertised to the Cloud Router.. BGP MED (Multi-Exit Discriminator) is the standard mechanism for influencing inbound traffic path selection when multiple connections exist between two autonomous systems. By setting a lower MED value on the on-premises router for prefixes advertised to the Cloud Router, the on-premises network can signal Google Cloud to prefer that specific VLAN attachment for traffic destined to the subnet, thereby correcting the suboptimal path.

Answer

Use route priorities on the Cloud Router for the learned routes.

Answer

Change the VLAN attachment's mode to active-active.

Answer

Set a lower cost on the Cloud Router interface for the preferred VLAN attachment.

Question 12

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

Accepted Answer

HA VPN with a single VPN gateway and a dynamic peer IP. HA VPN supports dynamic peer IP addresses through its use of IKEv2 and route-based VPN tunnels. When the branch office has a dynamic public IP, HA VPN can establish tunnels using the peer's current IP address, which is discovered during IKE negotiation. Classic VPN (option A) requires a static peer IP, and option D requires two static peer IPs, making them unsuitable for a dynamic IP scenario.

Answer

Classic VPN with a static IP on the peer

Answer

A custom SSL VPN appliance on Compute Engine

Answer

HA VPN with two VPN gateways and static peer IPs

Question 13

A company has deployed Dedicated Interconnect with a 10 Gbps connection. They are experiencing packet loss when transferring large files. The on-premises MTU is set to 1500. What is the maximum MTU that can be set on the Cloud Router interface to avoid fragmentation?

Accepted Answer

1500 bytes. Dedicated Interconnect uses VLAN attachments that encapsulate packets with an additional 4-byte 802.1Q VLAN tag and a 4-byte outer Ethernet header. With an on-premises MTU of 1500 bytes, the maximum payload that can traverse the interconnect without fragmentation is 1500 bytes, because the interconnect path supports jumbo frames up to 1440 bytes for the payload after overhead, but the Cloud Router interface MTU must match the on-premises MTU to avoid fragmentation. Setting the Cloud Router MTU to 1500 bytes ensures that packets are not fragmented at the router, as the interconnect handles the encapsulation overhead transparently.

Answer

1460 bytes

Answer

1400 bytes

Answer

8896 bytes

Question 14

Which TWO are valid methods to allow on-premises traffic to reach Google Cloud resources that only have internal (private) IP addresses? (Choose two.)

Accepted Answer

Set up Cloud VPN or Interconnect and configure proper routing and firewall rules.. Option A is correct because Cloud VPN (HA VPN) or Cloud Interconnect provides a private, encrypted or dedicated Layer 3 path between the on-premises network and the VPC, and once the tunnel/attachment is up you must configure Cloud Router BGP route advertisements (or static routes) plus VPC firewall rules to permit the on-premises source ranges to reach the internal IPs. Option E is correct because Private Google Access for on-premises hosts lets workloads without external IPs reach Google APIs and services using their internal IP addresses, by forwarding DNS and traffic through a Cloud VPN or Interconnect connection to the VPC's private.googleapis.com or restricted.googleapis.com VIPs. Option B is wrong because assigning public IPs changes the resources so they no longer 'only have internal (private) IP addresses,' and it exposes them to the internet rather than solving private reachability. Option C is wrong because Cloud NAT provides outbound-only translation for resources without external IPs; it does not accept inbound connections initiated from on-premises. Option D is wrong because a default internet gateway route carries traffic to the public internet and cannot deliver packets to VPC-internal addresses.

Answer

Assign public IP addresses to the resources and use firewall rules to allow on-premises traffic.

Answer

Use Cloud NAT to allow inbound connections from on-premises.

Answer

Use the default internet gateway route for the VPC.

Question 15

Refer to the exhibit. A BGP session between a Cloud Router and an on-premises router is not establishing. The Cloud Router logs show 'BGP_OPEN_MSG_ERROR: unsupported capability'. What is the most likely issue?

Accepted Answer

The on-premises router is attempting to negotiate a BGP capability that Cloud Router does not support, such as 4-byte ASNs or IPv6 unicast.. The error message 'BGP_OPEN_MSG_ERROR: unsupported capability' indicates that during the BGP OPEN message exchange, the on-premises router advertised a BGP capability (such as 4-byte ASN support or IPv6 unicast address family) that the Cloud Router does not support. This causes the Cloud Router to reject the OPEN message and reset the session. Option D correctly identifies this mismatch in negotiated capabilities.

Answer

The on-premises router cannot reach the Cloud Router's BGP IP.

Answer

The BGP session is stuck in the Connect state due to firewall blocking TCP port 179.

Answer

The BGP ASN configured on the Cloud Router doesn't match the peer.