PCNE Implementing Hybrid Interconnectivity Practice Test 7 — 15 Questions

Question 1

A company has set up a Cloud VPN with dynamic routing (BGP) between their on-premises network (AS 65001) and Google Cloud (AS 64514). They are using Cloud Router with a regional dynamic routing mode. The on-premises router is advertising a subnet 10.1.0.0/16. The Google Cloud VPC has subnet 10.2.0.0/16 in the same region as the Cloud Router. Both subnets are unique. The connection has been working for months. However, after a recent maintenance window, the on-premises router started experiencing BGP flapping with the Cloud Router. The Cloud Router logs show 'BGP notification sent: Hold timer expired'. The on-premises router logs show similar errors. The network team has verified that the VPN tunnel is established and stable. What is the most likely cause of the BGP flapping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises router's BGP hold timer is set to 30 seconds, but the Cloud Router's hold timer is set to 180 seconds.. The BGP hold timer defines the maximum time a router waits to receive a keepalive or update message from a peer before declaring the session dead. When the on-premises router uses a hold timer of 30 seconds and the Cloud Router uses 180 seconds, the on-premises router expects keepalives every 10 seconds (one-third of hold time). If the Cloud Router sends keepalives at its own negotiated interval (e.g., 60 seconds based on its hold timer), the on-premises router will not receive them within its 30-second window, causing it to send a 'Hold timer expired' notification and flap the BGP session. The VPN tunnel remains stable because the issue is at the BGP session layer, not the underlying tunnel.

Answer

The VPN tunnel's MTU is set to 1500 bytes, but BGP packets are larger and are being fragmented.

Answer

The Cloud Router's BGP keepalive interval is set to 30 seconds, while the on-premises router is using 10 seconds.

Answer

The on-premises router is advertising too many routes, causing the Cloud Router to run out of memory.

Question 2

A small company is moving their on-premises application to Google Cloud. They have a single on-premises office with a small router that supports IPsec VPN. They need a simple and low-cost connectivity solution that provides encryption and a consistent experience. They anticipate low bandwidth needs (under 100 Mbps). They also want the ability to use BGP for dynamic routing to avoid manual route updates. Which Google Cloud service should they use?

Accepted Answer

Cloud HA VPN with dynamic routing (BGP). Cloud HA VPN with dynamic routing (BGP) is the correct choice because it provides an encrypted IPsec tunnel, supports BGP for automatic route exchange, and is a low-cost, simple solution for sub-100 Mbps bandwidth needs. It meets the requirement for a consistent experience without the complexity or cost of dedicated interconnect services.

Answer

Partner Interconnect

Answer

Cloud Classic VPN with static routes

Answer

Direct Peering

Question 3

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They have two VLAN attachments (vlan-100 and vlan-200) connected to two separate Cloud Routers in the same region. Each Cloud Router has a BGP session with the on-premises router. The on-premises router advertises the same prefixes (10.0.0.0/8) over both sessions. In Google Cloud, they have workloads in two different VPCs: VPC-A and VPC-B. They want traffic to VPC-A to use vlan-100, and traffic to VPC-B to use vlan-200. Cloud Router 1 is attached to VPC-A, Cloud Router 2 is attached to VPC-B. Currently, traffic from on-premises to VPC-A sometimes goes through vlan-200, causing asymmetric routing. What configuration change should they make to ensure traffic is symmetric?

Accepted Answer

Use BGP community tags on the on-premises router to label routes for VPC-A and VPC-B, and configure route priority on Cloud Router to match these communities.. BGP community tags allow the on-premises router to tag routes for VPC-A and VPC-B differently. Cloud Router can then use these community tags to influence route priority (e.g., via local preference or MED matching), ensuring that traffic to VPC-A is always routed through vlan-100 and traffic to VPC-B through vlan-200, solving the asymmetric routing issue without relying on static routes or MED manipulation that would affect all traffic.

Answer

Set a higher MED on the on-premises router for routes advertised to vlan-200, making vlan-100 preferred for all traffic.

Answer

Configure static routes on the on-premises router to force traffic to VPC-A via vlan-100 and to VPC-B via vlan-200.

Answer

Create two separate VPCs and assign each VLAN attachment to a different VPC.

Question 4

A large enterprise has multiple on-premises data centers connected to Google Cloud via a combination of Dedicated Interconnect and Cloud VPN. They have a VPC with subnets in us-east1 and us-west1. The on-premises network advertises a prefix 10.0.0.0/8 to both Cloud Routers (each in different regions) via BGP. The Cloud Routers are configured with 'global' dynamic routing mode. The network team notices that traffic from Google Cloud instances in us-west1 to on-premises destinations in 10.0.0.0/8 is always taking the path to the closest on-premises data center (west coast) even though the west coast data center is currently under high load, causing performance degradation. The east coast data center is underutilized. They want to influence the path selection so that the west coast instances prefer the east coast data center during peak times. They are using BGP. What is the most effective method to achieve this?

Accepted Answer

Use BGP communities to tag routes from the west coast data center under load, and configure Cloud Router to match these communities and adjust the route priority (MED) accordingly.. BGP communities allow the west coast data center to tag its routes with a community value indicating high load. The Cloud Router can then be configured to match this community and adjust the route priority by lowering the MED (or local preference) for those routes, making the east coast data center's routes more preferred. This dynamic, policy-based approach directly addresses the need to shift traffic away from the overloaded west coast data center without manual reconfiguration.

Answer

Set a higher local preference on the west coast Cloud Router for routes received from the east coast data center.

Answer

Set a higher MED on the west coast data center's BGP advertisements to increase its desirability.

Answer

Configure the east coast data center to prepend one additional AS path hop to its advertised routes.

Question 5

A company has deployed Cloud HA VPN between their on-premises network and Google Cloud. They have two tunnels from the on-premises VPN appliance to the HA VPN gateway. The on-premises appliance uses a single public IP address for both tunnels, while the Cloud VPN gateway uses two different public IPs. BGP sessions are established over both tunnels, and the Cloud Router is configured with 'active/active' mode. The network team notices that all outbound traffic from Google Cloud to on-premises is using only one of the two tunnels, even though both tunnels are up. BGP metrics are identical for routes received over both sessions. What is the most likely cause?

Accepted Answer

The Cloud Router does not support ECMP when both BGP sessions have the same peer IP address.. Cloud Router uses the BGP peer IP address as part of the ECMP hash key. When both BGP sessions originate from the same on-premises public IP (the single IP used for both tunnels), Cloud Router sees them as the same peer and does not load-balance across them. Even though the tunnels use different Cloud VPN gateway IPs, the BGP sessions share a common peer IP, which prevents ECMP from being enabled.

Answer

The BGP sessions have different hold timers causing one to be preferred.

Answer

The on-premises appliance must use two different public IPs for ECMP to work.

Answer

The Cloud Router must be configured with 'active/standby' mode instead of 'active/active'.

Question 6

A company is planning to connect their on-premises data center to Google Cloud. They require high bandwidth (10 Gbps) and low latency for real-time data replication. They also want a cost-effective solution that supports burstable traffic. Which TWO connectivity options should they consider? (Choose TWO.)

Accepted Answer

Partner Interconnect. Partner Interconnect (C) is correct because it provides a supported 10 Gbps connection through a service provider, delivering the high bandwidth and low latency needed for real-time replication while allowing the provider to handle the physical connectivity, which can be cost-effective for burstable traffic. Dedicated Interconnect (D) is also correct because it offers a direct 10 Gbps (or higher) connection to Google Cloud with low latency and high throughput, and its billing model supports burstable traffic beyond the committed capacity, making it suitable for this scenario. Classic VPN (A) and Cloud VPN (B) are incorrect because IPsec VPNs typically max out at 3 Gbps per tunnel and introduce encryption overhead and higher latency, which cannot meet the 10 Gbps low-latency requirement. Direct Peering (E) is incorrect because it is used for peering with Google's public services, not for private connectivity to a VPC network, and does not provide the dedicated private path required for data replication.

Answer

Classic VPN (route-based VPN)

Answer

Cloud VPN (IPsec VPN)

Answer

Direct Peering

Question 7

A financial institution is setting up Dedicated Interconnect with Google Cloud. They have two on-premises routers (R1 and R2) each connected to a separate Google Cloud router via VLAN attachments in two different zones (us-central1-a and us-central1-b). The on-premises routers are configured with BGP, and they advertise the corporate prefix 10.0.0.0/8. Google Cloud routers are configured with custom route advertisements. After provisioning, you notice that traffic from some on-premises subnets to GCP experiences asymmetrical routing, causing packet drops. You verify that both BGP sessions are established and that both Cloud Routers have received the 10.0.0.0/8 route. What is the most likely cause of the asymmetrical routing?

Accepted Answer

On-premises routers have mismatched BGP local preference values for routes received from Google Cloud. Asymmetrical routing in a dual-homed Dedicated Interconnect setup occurs when on-premises routers have different BGP local preference values for routes received from Google Cloud. Local preference is the first BGP attribute considered when selecting the best path outbound from the on-premises network. If R1 has a higher local preference for the GCP routes than R2, all outbound traffic from on-premises will prefer R1, while return traffic from GCP may arrive via either router (depending on GCP's routing), causing a mismatch in traffic paths and packet drops.

Answer

The on-premises routers are using the same AS number causing BGP loop prevention

Answer

VLAN attachments are configured with different MTU sizes

Answer

Cloud Router is setting different BGP metric attributes for each VLAN attachment

Question 8

A company currently uses a site-to-site Cloud VPN (IPsec) to connect their on-premises network to a VPC. Due to growing bandwidth demands, they plan to migrate to Partner Interconnect using a supported service provider. They have ordered a 1 Gbps connection and the provider has indicated the VLAN attachment is ready. After creating the VLAN attachment and pairing it with a Cloud Router, the on-premises router sees the BGP session come up, but no traffic is forwarded over the interconnect. The Cloud VPN is still operational. What step is most likely missing?

Accepted Answer

Adjust the BGP metric (MED) on the Cloud Router for the Partner Interconnect VLAN attachment to be lower than the VPN route. When both a Cloud VPN and a Partner Interconnect are connected to the same VPC, the Cloud Router will have multiple BGP routes for the same destination prefixes. By default, the VPN BGP session may have a lower MED (Multi-Exit Discriminator) or a higher local preference, causing traffic to prefer the VPN path. Lowering the MED on the VLAN attachment's BGP session makes the interconnect route more preferred, allowing traffic to be forwarded over the interconnect without deleting the VPN.

Answer

Create a VPC firewall rule to allow traffic on the VLAN attachment

Answer

Add a firewall rule in the VPC allowing traffic from the on-premises IP ranges on the interconnect

Answer

Delete the Cloud VPN tunnel and gateway to force traffic over the interconnect

Question 9

A large enterprise has two on-premises data centers (DC1 and DC2) connected to Google Cloud via two separate VPN tunnels to the same VPC. Each tunnel terminates on a different Cloud VPN gateway (gateway1 in us-east1, gateway2 in us-west1). The on-premises routers advertise the same CIDR 172.16.0.0/12 from both DCs. Cloud Router is configured with BGP and uses default route priority. You notice that after a failover event where one tunnel goes down, traffic continues to flow, but there is a significant increase in latency for traffic coming from GCP to on-premises. You verify that both tunnels have re-established. What is the most likely cause of the increased latency?

Accepted Answer

The on-premises routers do not use AS path prepending to prefer the local DC's path for the prefix. When both on-premises routers advertise the same CIDR (172.16.0.0/12) to Google Cloud via BGP, Cloud Router selects the path with the shorter AS path length by default. Without AS path prepending on the backup DC's router, both routes have equal AS path length, causing Cloud Router to load-balance or pick a suboptimal path after failover. After the tunnel re-establishes, traffic from GCP may still be routed to the remote DC (e.g., DC2) instead of the local DC (DC1), resulting in higher latency due to cross-country or inter-DC transit.

Answer

The on-premises routers are using site-to-site VPN between themselves causing a routing loop

Answer

The Cloud VPN tunnels are using different preshared keys

Answer

Bidirectional Forwarding Detection (BFD) is not enabled on the Cloud VPN tunnels

Question 10

A company has a Cloud VPN tunnel with dynamic routing (BGP) connecting their on-premises network to a VPC in us-central1. They recently added a new subnet (10.2.0.0/16) to the VPC. The on-premises network still cannot reach resources in the new subnet. The Cloud Router BGP session is established and routes from on-prem are being received. What is the most likely cause?

Accepted Answer

The new subnet range is not included in the Cloud Router's advertised routes. When a new subnet is added to a VPC, the Cloud Router must be configured to advertise that subnet's CIDR range to the on-premises BGP peer. Even though the BGP session is established and routes from on-premises are received, the Cloud Router will not automatically advertise the new subnet unless its advertised route list is updated. Without the new subnet in the Cloud Router's advertised routes, the on-premises network has no path to reach 10.2.0.0/16, causing connectivity failure.

Answer

The Cloud Router does not support more than 10 custom dynamic routes

Answer

BGP session is not established

Answer

Firewall rules are blocking traffic

Question 11

A financial services firm needs to connect their on-premises data center to Google Cloud VPC with 50 Gbps of bandwidth and latency under 5 ms. They are in a metropolitan area with a Google Cloud region. They require an SLA of 99.99% and need to support VLAN attachments to multiple VPCs. Which connectivity option should they choose?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect is the correct choice because it provides direct, private connections between the on-premises data center and Google Cloud VPC, supporting up to 80 Gbps per interconnect (via 8 x 10 Gbps links) and offering a 99.99% SLA when configured with redundant links. It supports VLAN attachments (VLANs) to multiple VPCs, enabling segmentation across different environments, and meets the sub-5 ms latency requirement within a metropolitan area with a Google Cloud region.

Answer

Direct Peering

Answer

Cloud VPN with multiple tunnels and ECMP

Answer

Partner Interconnect

Question 12

An organization has two Cloud VPN tunnels from the same on-premises router to a Cloud Router in Google Cloud. Both tunnels are using BGP, and the on-premises router is sending the same routes over both tunnels. The Cloud Router is configured to use 'route propagation' from a VPC network. Which of the following is true regarding route priority?

Accepted Answer

Cloud Router will use both tunnels for load balancing (ECMP) if the routes are identical. When both BGP routes are identical in prefix, AS path, local preference, MED, and other attributes, Cloud Router uses ECMP (Equal-Cost Multi-Path) to load balance traffic across both Cloud VPN tunnels. Route propagation in the VPC network does not alter the BGP best-path selection; it simply injects the learned routes into the VPC routing table. Since the on-premises router advertises the same routes over both tunnels, Cloud Router treats them as equal-cost paths and distributes traffic across both tunnels.

Answer

The tunnel with the lower local preference value will be used

Answer

The tunnel with the higher BGP MED value will be preferred

Answer

Only the tunnel with the lowest IP address will be used

Question 13

A company has a VPC with subnets in us-east1 and us-west1. They have established a Cloud VPN tunnel to their on-premises network through a Cloud Router in us-east1. They want to ensure that traffic from on-premises to resources in us-west1 uses the VPN tunnel and not the public internet. What must be configured?

Accepted Answer

Add a route on the on-premises router for us-west1 subnets with next hop pointing to the VPN tunnel. The on-premises router must have a route for the us-west1 subnets with the VPN tunnel as the next hop. Without this, the on-premises router will use its default route (typically the public internet) to reach us-west1, bypassing the VPN tunnel. The Cloud Router in us-east1 advertises the us-west1 subnets via BGP over the VPN tunnel, but the on-premises router must be explicitly configured to forward traffic for those subnets into the tunnel.

Answer

Configure a custom dynamic route on the Cloud Router for us-west1 subnets

Answer

Create a separate VPN tunnel from on-premises to a Cloud Router in us-west1

Answer

Configure VPC firewall rules to allow traffic from on-premises to us-west1

Question 14

A company has deployed an HA VPN gateway in Google Cloud to connect to their on-premises network. They have configured two tunnels with IKEv2 and BGP. One tunnel is established, but the second tunnel is not coming up. What could be a likely cause?

Accepted Answer

The pre-shared keys are mismatched between the two tunnels. Common issues include mismatched pre-shared keys or IKE versions. Since the first tunnel works, the configuration is mostly correct, but the second tunnel may have a different pre-shared key or PSK mismatch. Incorrect IKE version is less likely because both tunnels use the same gateway. BGP timers are usually consistent. Cloud VPN logs would help identify the root cause.

Answer

IKE version is set to IKEv1 on one side

Answer

The second tunnel's peer IP is unreachable

Answer

BGP timers are inconsistent

Question 15

An engineer needs to set up DNS resolution for on-premises resources from Google Cloud. They want to resolve a custom domain (e.g., corp.example.com) using on-premises DNS servers. Which Cloud DNS feature should they use?

Accepted Answer

DNS forwarding zone. DNS forwarding zones in Cloud DNS allow you to forward queries for a specific domain to a set of on-premises DNS server IPs. This is achieved by creating a forwarding zone with the target name servers pointing to the on-premises DNS servers.

Answer

Cloud DNS peering

Answer

Outbound DNS forwarding

Answer

Inbound DNS policy