PCNE Implementing Hybrid Interconnectivity Practice Test 5 — 15 Questions

Question 1

A company needs private connectivity between its on-premises data center and Google Cloud with consistent low latency and high throughput. The on-premises location is close to a Google Cloud point of presence that supports Dedicated Interconnect. The company expects to use more than 10 Gbps of bandwidth in the near future. Which connectivity solution should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, offering consistent low latency and high throughput. Since the on-premises location is near a Google Cloud point of presence that supports Dedicated Interconnect and the bandwidth requirement exceeds 10 Gbps (Dedicated Interconnect supports up to 10 Gbps per circuit, with multiple circuits for higher aggregate bandwidth), this is the optimal solution.

Answer

Partner Interconnect

Answer

HA VPN with dynamic routing

Answer

Cloud VPN with static routing

Question 2

A company has set up an HA VPN tunnel between their on-premises router and a Cloud Router in Google Cloud. The on-premises router establishes BGP sessions to both Cloud Router instances, but the routes learned from one Cloud Router instance are not being received. The other instance works fine. What is the most likely cause?

Accepted Answer

The on-premises router has a firewall blocking BGP updates only on one IP address. The most likely cause is a firewall blocking BGP updates only on one IP address. In Google Cloud HA VPN, each Cloud Router instance uses a separate BGP IP address for the two tunnels. If a firewall on the on-premises router is blocking BGP traffic (TCP port 179) to one of these IP addresses but not the other, BGP sessions can establish (since session establishment uses a different mechanism or the firewall rule is applied incorrectly to the data plane), but BGP updates carrying routes may be dropped. This explains why one session receives routes while the other does not. An incorrect ASN would prevent BGP session establishment entirely, which contradicts the stem that states BGP sessions are established. Similarly, a failed tunnel would prevent session establishment, and advertisement mode 'Custom' would affect both sessions equally.

Answer

The tunnel is in a failed state

Answer

The on-premises router has incorrect ASN configured for that BGP session

Answer

The Cloud Router is set to advertisement mode 'Custom' and does not advertise all subnets

Question 3

A company is designing an HA VPN to connect their on-premises data center to Google Cloud VPC. The on-premises router supports two independent interfaces with public IPs. They want to achieve 99.99% availability for the VPN connection, understanding that HA VPN uses two tunnels and two Cloud Router instances. Which configuration meets this goal?

Accepted Answer

Four tunnels: one tunnel from each on-premises interface to each Cloud Router instance, totaling four BGP sessions. HA VPN requires at least two Cloud Router instances and two tunnels from each on-premises interface to each Cloud Router instance to achieve 99.99% availability. This configuration creates four BGP sessions, ensuring that if one on-premises interface, one Cloud Router, or one tunnel fails, traffic can still flow through the remaining paths. The design leverages both redundancy of interfaces and redundancy of Cloud Routers to meet the high availability SLA.

Answer

Two tunnels: both tunnels from the same on-premises interface to two different Cloud Router instances

Answer

Two tunnels: each tunnel from a separate on-premises interface to the same Cloud Router instance

Answer

Four tunnels: two tunnels from each on-premises interface to the same Cloud Router instance

Question 4

A company has deployed a Dedicated Interconnect with multiple VLAN attachments connected to a single Cloud Router. They want to influence inbound traffic from on-premises to Google Cloud to use a specific attachment for certain prefixes. Which BGP attribute can they manipulate on the on-premises router to achieve this?

Accepted Answer

MED. The Multi-Exit Discriminator (MED) attribute is used to influence inbound traffic from on-premises to Google Cloud when multiple paths exist via a Dedicated Interconnect. By setting a lower MED value on the on-premises router for specific prefixes, the Cloud Router will prefer that attachment for those prefixes, as MED is compared first among paths from the same neighboring AS.

Answer

AS_PATH

Answer

LOCAL_PREF

Answer

Community tags

Question 5

A global company has multiple on-premises data centers connected to Google Cloud via separate Dedicated Interconnects. Each on-premises site advertises the same IP prefix for a critical application. They want to ensure that traffic from Google Cloud to that prefix is load-balanced across the two interconnects and also provide automatic failover. Which configuration on Cloud Router meets this requirement?

Accepted Answer

Ensure on-premises routers advertise the prefix with the same AS_PATH length and MED. For Cloud Router to load-balance traffic across multiple Dedicated Interconnects and provide automatic failover, the on-premises routers must advertise the same prefix with equal BGP attributes: same AS_PATH length and same MED. Cloud Router uses BGP best path selection, and equal attributes allow multipath (ECMP) load balancing. This configuration ensures both paths are considered equal and traffic is distributed.

Answer

Configure Cloud Router with the same MED value for both paths

Answer

Use BGP multipath on Cloud Router with 'maximum-paths' set to 2

Answer

Enable 'set-community' on the on-premises routers to mark routes equally

Question 6

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

Accepted Answer

Dedicated Interconnect with static routing. Dedicated Interconnect supports static routing, which is required because the on-premises router does not support BGP. This solution provides direct, private connectivity to a single Google Cloud VPC without relying on dynamic routing protocols, making it the correct choice for this scenario.

Answer

Cloud VPN with dynamic routing (BGP)

Answer

Ha VPN with policy-based routing

Answer

Partner Interconnect with BGP

Question 7

A company has two Dedicated Interconnects in different metro regions connecting to Google Cloud. They want to use BGP communities to influence Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises. Which community action can they apply on the on-premises routers?

Accepted Answer

Set BGP community 79ba:100 on routes from the preferred interconnect. Google Cloud uses 16-bit ASN format for BGP communities, and the well-known community 79ba:100 (equivalent to 31210:256 in decimal) is a Google-defined community that sets a higher local preference on routes received from the preferred interconnect. This influences Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises, as higher local preference is evaluated before MED or AS-path length.

Answer

Set BGP community 2:100 on routes to indicate MED change

Answer

Set BGP community 0:100 on routes to mark them as high preference

Answer

Set BGP community 79ba:101 on routes from the preferred interconnect

Question 8

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They require high availability for the connection. Which TWO of the following are recommended by Google for achieving high availability? (Choose two.)

Accepted Answer

Order two Dedicated Interconnect connections in the same metro. Google's recommended topology for highly available Dedicated Interconnect is to provision two or more connections in separate Interconnect locations (POPs), which is exactly what option E describes, so that a single POP or facility failure cannot take down all connectivity. Option D is also correct because ordering two Dedicated Interconnect connections in the same metro provides redundancy at the connection level and, when placed in different edge availability domains, satisfies Google's 99.9% availability SLA for Dedicated Interconnect. Option A is wrong because a single connection with double bandwidth is still a single point of failure and does not meet the high-availability requirement. Option B is insufficient on its own because two edge availability domains within the same POP still share that POP's facility and fiber paths, so a POP-level outage would affect both. Option C is incorrect because Dedicated Interconnect is ordered directly from Google, not from two different service providers; using two providers is characteristic of Partner Interconnect or a hybrid approach, not the Dedicated Interconnect high-availability recommendation.

Answer

Use a single Dedicated Interconnect with double the bandwidth

Answer

Connect to two different edge availability domains in the same POP

Answer

Order connections from two different service providers

Question 9

A company currently uses Cloud VPN with dynamic routing to connect to Google Cloud. They want to migrate to Dedicated Interconnect without downtime. Which THREE steps should they take to achieve a seamless migration? (Choose three.)

Accepted Answer

Order and provision the Dedicated Interconnect. Option A is correct because the physical Dedicated Interconnect connection must first be ordered and provisioned before any logical connectivity can be established; this is the foundational step of the migration. Option B is correct because BGP must be configured on the on-premises router to establish a BGP session with the Interconnect's Cloud Router and advertise the on-premises routes so traffic can flow over the new link. Option C is correct because creating a new VLAN attachment and attaching it to the existing Cloud Router allows the router to peer with both the existing Cloud VPN and the new Interconnect simultaneously, enabling a graceful, non-disruptive transition. Option D is not required for a seamless migration because BGP already prefers the Interconnect over the VPN by default (Interconnect has higher priority than VPN in Cloud Router), so manually lowering the VPN's MED is unnecessary. Option E is not a migration step specific to establishing the Interconnect; firewall rules on-premises are typically already permitting the relevant traffic and are not part of the core migration sequence.

Answer

Decrease the BGP route priority (MED) on the VPN advertisements to make VPN less preferred

Answer

Update on-premises firewall rules to allow traffic over the new Interconnect

Question 10

An organization is experiencing high latency on their Partner Interconnect connection. Which TWO tools or features can they use to diagnose the issue from within Google Cloud? (Choose two.)

Accepted Answer

VPC Flow Logs. Option D (VPC Flow Logs) is correct because VPC Flow Logs capture IP traffic metadata for VM instances and can reveal packet loss, retransmissions, and traffic patterns that indicate where latency or drops occur along the path, helping diagnose Partner Interconnect issues from within Google Cloud. Option E (Cloud Interconnect monitoring metrics) is correct because Cloud Interconnect exposes dedicated metrics in Cloud Monitoring, such as interconnect attachment capacity, received/sent bytes, and link-level health, which are essential for identifying congestion or degradation on the Partner Interconnect link itself. Option A (Network Intelligence Center performance dashboard) is not marked correct here, as it primarily provides network topology and performance views for Google Cloud resources rather than direct Partner Interconnect link diagnostics in this scenario. Option B (Cloud Router logs) is not marked correct because Cloud Router logs focus on BGP session and route exchange events, not on latency measurement across the interconnect. Option C (Cloud Load Balancing logs) is not marked correct because load balancer logs record request-level data for proxied traffic and do not diagnose underlying Partner Interconnect latency.

Answer

Network Intelligence Center performance dashboard

Answer

Cloud Router logs

Answer

Cloud Load Balancing logs

Question 11

An engineer runs the command above to check the status of a Dedicated Interconnect VLAN attachment. The state shows DEFECTIVE. The associated interconnect connection is in ACTIVE state. What is the most likely cause?

Accepted Answer

The VLAN ID is already in use on a different attachment on the same interconnect. A Dedicated Interconnect VLAN attachment showing DEFECTIVE state while the interconnect connection itself is ACTIVE indicates a configuration conflict at the VLAN level. The most common cause is that the VLAN ID specified for this attachment is already allocated to another VLAN attachment on the same interconnect, as VLAN IDs must be unique per interconnect. This conflict prevents the attachment from establishing proper Layer 2 connectivity, resulting in a DEFECTIVE state.

Answer

The Cloud Router is not configured with a BGP session for this attachment

Answer

The maximum number of VLAN attachments for this interconnect has been exceeded

Answer

The data center power is down

Question 12

A network engineer sees the above output from a Cloud Router. There are two BGP peers from the on-premises router (10.0.0.1 and 10.0.0.2). Both learned the same route 10.1.0.0/16 from their respective peers. However, traffic from Google Cloud to 10.1.0.0/16 is only going through the first peer (10.0.0.1) and not load-balanced. What could be the reason?

Accepted Answer

The on-premises router is advertising the route with different MED values. BGP uses the MED (Multi-Exit Discriminator) attribute to influence inbound traffic from a neighboring AS. When the on-premises router advertises the same route (10.1.0.0/16) to the Cloud Router via two peers (10.0.0.1 and 10.0.0.2) with different MED values, the Cloud Router will prefer the route with the lower MED value. This causes all traffic to be sent through the peer with the lower MED, preventing load balancing. By default, Cloud Router does not perform ECMP (Equal-Cost Multi-Path) for BGP routes unless the paths are identical in all BGP path selection criteria, including MED.

Answer

The on-premises router is advertising the route with different AS_PATH lengths

Answer

The VPC routing mode is set to 'global'

Answer

Cloud Router has a limit of one route per prefix

Question 13

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

Accepted Answer

The BGP routes for that subnet are not advertised.. The Dedicated Interconnect is up and the organization can ping instances in one subnet, which confirms that Layer 2 and basic Layer 3 connectivity (via the VLAN attachment) are working. However, the inability to reach a service on a different subnet within the same VPC indicates that the on-premises router does not have a route to that specific subnet. This is most likely because the BGP session is not advertising the prefix for that subnet, or the on-premises router is not receiving the route via BGP. Without the route, traffic from on-premises to that subnet will be dropped.

Answer

The MTU is too small.

Answer

The firewall rules are blocking the traffic.

Answer

The VLAN attachment is down.

Question 14

When setting up a Partner Interconnect, which Google Cloud resource is used to connect to the partner's network?

Accepted Answer

VLAN attachment. When setting up a Partner Interconnect, the correct Google Cloud resource is a VLAN attachment. This attachment is provisioned on a Cloud Interconnect connection that is managed by a supported service provider, and it defines the VLAN and the Cloud Router configuration used to exchange routes via BGP. The VLAN attachment is the logical construct that connects your VPC network to the partner's network through the partner's physical infrastructure.

Answer

Cloud VPN gateway

Answer

Cloud Interconnect attachment

Answer

Cloud Router

Question 15

A customer has established a Dedicated Interconnect, but traffic from on-premises to Google Cloud is still using the internet path instead of the interconnect. What is the most likely cause?

Accepted Answer

The BGP routes from on-premises have a lower priority than the default route via internet.. Google Cloud uses route priority to determine which route is used when multiple routes match a destination. The default route (0.0.0.0/0) is a system route with priority 0 (highest priority). BGP routes learned via Dedicated Interconnect have a priority of 200 (lower priority). When both exist, the route with the lower priority number (higher priority) wins, so the default route via the internet takes precedence over the BGP routes from the interconnect. This causes traffic to use the internet path instead of the interconnect.

Answer

The on-premises firewall blocks BGP traffic.

Answer

The Google Cloud Router has not learned any routes.

Answer

The VLAN attachment is in a different region.