PCNE Implementing Hybrid Interconnectivity Practice Test 7 — 15 Questions

Question 1

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable IP forwarding on the VPN appliance VM instance.. A third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.

Answer

Create a custom route in the VPC pointing to the VPN appliance's internal IP.

Answer

Enable Private Google Access on the subnet hosting the VPN appliance.

Answer

Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.

Question 2

A company needs private connectivity between its on-premises data center and Google Cloud with consistent low latency and high throughput. The on-premises location is close to a Google Cloud point of presence that supports Dedicated Interconnect. The company expects to use more than 10 Gbps of bandwidth in the near future. Which connectivity solution should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, offering consistent low latency and high throughput. Since the on-premises location is near a Google Cloud point of presence that supports Dedicated Interconnect and the bandwidth requirement exceeds 10 Gbps (Dedicated Interconnect supports up to 10 Gbps per circuit, with multiple circuits for higher aggregate bandwidth), this is the optimal solution.

Answer

Partner Interconnect

Answer

HA VPN with dynamic routing

Answer

Cloud VPN with static routing

Question 3

A company has set up an HA VPN tunnel between their on-premises router and a Cloud Router in Google Cloud. The on-premises router establishes BGP sessions to both Cloud Router instances, but the routes learned from one Cloud Router instance are not being received. The other instance works fine. What is the most likely cause?

Accepted Answer

The on-premises router has a firewall blocking BGP updates only on one IP address. The most likely cause is a firewall blocking BGP updates only on one IP address. In Google Cloud HA VPN, each Cloud Router instance uses a separate BGP IP address for the two tunnels. If a firewall on the on-premises router is blocking BGP traffic (TCP port 179) to one of these IP addresses but not the other, BGP sessions can establish (since session establishment uses a different mechanism or the firewall rule is applied incorrectly to the data plane), but BGP updates carrying routes may be dropped. This explains why one session receives routes while the other does not. An incorrect ASN would prevent BGP session establishment entirely, which contradicts the stem that states BGP sessions are established. Similarly, a failed tunnel would prevent session establishment, and advertisement mode 'Custom' would affect both sessions equally.

Answer

The tunnel is in a failed state

Answer

The on-premises router has incorrect ASN configured for that BGP session

Answer

The Cloud Router is set to advertisement mode 'Custom' and does not advertise all subnets

Question 4

A company is designing an HA VPN to connect their on-premises data center to Google Cloud VPC. The on-premises router supports two independent interfaces with public IPs. They want to achieve 99.99% availability for the VPN connection, understanding that HA VPN uses two tunnels and two Cloud Router instances. Which configuration meets this goal?

Accepted Answer

Four tunnels: one tunnel from each on-premises interface to each Cloud Router instance, totaling four BGP sessions. HA VPN requires at least two Cloud Router instances and two tunnels from each on-premises interface to each Cloud Router instance to achieve 99.99% availability. This configuration creates four BGP sessions, ensuring that if one on-premises interface, one Cloud Router, or one tunnel fails, traffic can still flow through the remaining paths. The design leverages both redundancy of interfaces and redundancy of Cloud Routers to meet the high availability SLA.

Answer

Two tunnels: both tunnels from the same on-premises interface to two different Cloud Router instances

Answer

Two tunnels: each tunnel from a separate on-premises interface to the same Cloud Router instance

Answer

Four tunnels: two tunnels from each on-premises interface to the same Cloud Router instance

Question 5

An organization uses Partner Interconnect to connect their on-premises network to Google Cloud. They are experiencing intermittent connectivity issues and suspect the partner service provider is causing the problem. Which Google Cloud tool or feature can help verify the connection status and performance from the Google Cloud side?

Accepted Answer

Cloud Interconnect monitoring. Cloud Interconnect monitoring provides detailed metrics and status information for Partner Interconnect connections, including VLAN attachment health, throughput, and packet loss. This tool allows you to verify connectivity and performance from the Google Cloud side, helping isolate issues that may originate from the partner service provider.

Answer

Cloud Router logs

Answer

Network Service Tiers

Answer

VPC flow logs

Question 6

A company has deployed a Dedicated Interconnect with multiple VLAN attachments connected to a single Cloud Router. They want to influence inbound traffic from on-premises to Google Cloud to use a specific attachment for certain prefixes. Which BGP attribute can they manipulate on the on-premises router to achieve this?

Accepted Answer

MED. The Multi-Exit Discriminator (MED) attribute is used to influence inbound traffic from on-premises to Google Cloud when multiple paths exist via a Dedicated Interconnect. By setting a lower MED value on the on-premises router for specific prefixes, the Cloud Router will prefer that attachment for those prefixes, as MED is compared first among paths from the same neighboring AS.

Answer

AS_PATH

Answer

LOCAL_PREF

Answer

Community tags

Question 7

A global company has multiple on-premises data centers connected to Google Cloud via separate Dedicated Interconnects. Each on-premises site advertises the same IP prefix for a critical application. They want to ensure that traffic from Google Cloud to that prefix is load-balanced across the two interconnects and also provide automatic failover. Which configuration on Cloud Router meets this requirement?

Accepted Answer

Ensure on-premises routers advertise the prefix with the same AS_PATH length and MED. To load-balance and provide failover, you need equal-cost multi-path (ECMP) routing. Cloud Router supports ECMP only when the routes have the same MED and AS_PATH length. Setting both on-premises routers to advertise with the same attributes allows ECMP.

Answer

Configure Cloud Router with the same MED value for both paths

Answer

Use BGP multipath on Cloud Router with 'maximum-paths' set to 2

Answer

Enable 'set-community' on the on-premises routers to mark routes equally

Question 8

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

Accepted Answer

Dedicated Interconnect with static routing. Dedicated Interconnect supports static routing, which is required because the on-premises router does not support BGP. This solution provides direct, private connectivity to a single Google Cloud VPC without relying on dynamic routing protocols, making it the correct choice for this scenario.

Answer

Cloud VPN with dynamic routing (BGP)

Answer

Ha VPN with policy-based routing

Answer

Partner Interconnect with BGP

Question 9

A company is using Cloud VPN to connect to Google Cloud. They notice that traffic from their on-premises network to Google Cloud is not being routed correctly after a recent change. On the on-premises router, they verify that the BGP session is established and routes are received. Which step should they take next to troubleshoot?

Accepted Answer

Verify that the routes learned via BGP are being propagated to the VPC network by examining Cloud Router details. Since the BGP session is established and routes are received on the on-premises router, the issue is likely that those routes are not being propagated into the VPC network. Cloud Router acts as the BGP speaker for the VPC; even if the VPN tunnel is up and BGP peering is successful, the learned routes must be advertised into the VPC’s routing tables. Verifying Cloud Router details (e.g., using `gcloud compute routers get-status` or checking the Cloud Console) confirms whether the routes are being accepted and propagated, which directly addresses the routing failure.

Answer

Check the on-premises firewall logs

Answer

Disable and re-enable the VPN tunnel

Answer

Check the tunnel status in Cloud Console

Question 10

A company has two Dedicated Interconnects in different metro regions connecting to Google Cloud. They want to use BGP communities to influence Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises. Which community action can they apply on the on-premises routers?

Accepted Answer

Set BGP community 79ba:100 on routes from the preferred interconnect. Google Cloud uses 16-bit ASN format for BGP communities, and the well-known community 79ba:100 (equivalent to 31210:256 in decimal) is a Google-defined community that sets a higher local preference on routes received from the preferred interconnect. This influences Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises, as higher local preference is evaluated before MED or AS-path length.

Answer

Set BGP community 2:100 on routes to indicate MED change

Answer

Set BGP community 0:100 on routes to mark them as high preference

Answer

Set BGP community 79ba:101 on routes from the preferred interconnect

Question 11

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They require high availability for the connection. Which TWO of the following are recommended by Google for achieving high availability? (Choose two.)

Accepted Answer

Order two Dedicated Interconnect connections in the same metro. Google recommends ordering two Dedicated Interconnect connections in the same metro to provide link-level redundancy. Option E is correct because connecting to two different Interconnect locations (POPs) provides site-level redundancy, protecting against a single POP failure. Together, these two approaches ensure high availability for the hybrid connection.

Answer

Use a single Dedicated Interconnect with double the bandwidth

Answer

Connect to two different edge availability domains in the same POP

Answer

Order connections from two different service providers

Question 12

A company currently uses Cloud VPN with dynamic routing to connect to Google Cloud. They want to migrate to Dedicated Interconnect without downtime. Which THREE steps should they take to achieve a seamless migration? (Choose three.)

Accepted Answer

Order and provision the Dedicated Interconnect. Ordering and provisioning the Dedicated Interconnect is the foundational step to establish the physical connection between the on-premises network and Google Cloud. Without this, no migration can occur. This involves working with a Google Cloud partner to ensure the cross-connect is completed and the VLAN attachments are created.

Answer

Decrease the BGP route priority (MED) on the VPN advertisements to make VPN less preferred

Answer

Update on-premises firewall rules to allow traffic over the new Interconnect

Question 13

An organization is experiencing high latency on their Partner Interconnect connection. Which TWO tools or features can they use to diagnose the issue from within Google Cloud? (Choose two.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about network traffic flowing to and from VPC instances, including latency-related metrics such as packet loss and retransmissions. By analyzing these logs, you can identify if high latency is caused by dropped packets or congestion on the Partner Interconnect link. This makes VPC Flow Logs a direct diagnostic tool for latency issues from within Google Cloud.

Answer

Network Intelligence Center performance dashboard

Answer

Cloud Router logs

Answer

Cloud Load Balancing logs

Question 14

An engineer runs the command above to check the status of a Dedicated Interconnect VLAN attachment. The state shows DEFECTIVE. The associated interconnect connection is in ACTIVE state. What is the most likely cause?

Accepted Answer

The VLAN ID is already in use on a different attachment on the same interconnect. A Dedicated Interconnect VLAN attachment showing DEFECTIVE state while the interconnect connection itself is ACTIVE indicates a configuration conflict at the VLAN level. The most common cause is that the VLAN ID specified for this attachment is already allocated to another VLAN attachment on the same interconnect, as VLAN IDs must be unique per interconnect. This conflict prevents the attachment from establishing proper Layer 2 connectivity, resulting in a DEFECTIVE state.

Answer

The Cloud Router is not configured with a BGP session for this attachment

Answer

The maximum number of VLAN attachments for this interconnect has been exceeded

Answer

The data center power is down

Question 15

A network engineer sees the above output from a Cloud Router. There are two BGP peers from the on-premises router (10.0.0.1 and 10.0.0.2). Both learned the same route 10.1.0.0/16 from their respective peers. However, traffic from Google Cloud to 10.1.0.0/16 is only going through the first peer (10.0.0.1) and not load-balanced. What could be the reason?

Accepted Answer

The on-premises router is advertising the route with different MED values. BGP uses the MED (Multi-Exit Discriminator) attribute to influence inbound traffic from a neighboring AS. When the on-premises router advertises the same route (10.1.0.0/16) to the Cloud Router via two peers (10.0.0.1 and 10.0.0.2) with different MED values, the Cloud Router will prefer the route with the lower MED value. This causes all traffic to be sent through the peer with the lower MED, preventing load balancing. By default, Cloud Router does not perform ECMP (Equal-Cost Multi-Path) for BGP routes unless the paths are identical in all BGP path selection criteria, including MED.

Answer

The on-premises router is advertising the route with different AS_PATH lengths

Answer

The VPC routing mode is set to 'global'

Answer

Cloud Router has a limit of one route per prefix