PCNE Implementing Hybrid Interconnectivity Practice Test 8 — 15 Questions

Question 1

An engineer configured a Cloud Router with the above settings. The VPC network has subnets 10.1.0.0/16 and 10.2.0.0/16, as well as subnets 10.3.0.0/16 and 10.4.0.0/16. The on-premises router is only receiving routes for 10.1.0.0/16 and 10.2.0.0/16 but not for 10.3.0.0/16 and 10.4.0.0/16. What is the cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Cloud Router is set to custom advertisement mode, and the missing subnets are not included in the advertised IP ranges. When a Cloud Router is configured in custom advertisement mode, it only advertises the specific CIDR ranges explicitly listed in the 'Advertised IP ranges' field. Since the missing subnets (10.3.0.0/16 and 10.4.0.0/16) are not included in that list, they are not propagated via BGP to the on-premises router, even though they exist in the VPC.

Answer

The BGP session is not established

Answer

The Cloud Router is in global routing mode, which does not advertise all subnets

Answer

The on-premises router has a filter that blocks the other routes

Question 2

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

Accepted Answer

Configure active-active BGP with multiple sessions using the same ASN.. The best practice for HA VPN is to use active-active BGP with multiple sessions, using the same ASN on all on-premises routers. This enables ECMP and ensures symmetric routing. Option B correctly describes this configuration.

Answer

Configure active-passive BGP with a single session.

Answer

Use policy-based routing to fail between tunnels.

Answer

Use static routes with a primary and backup route.

Question 3

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

Accepted Answer

The BGP routes for that subnet are not advertised.. The Dedicated Interconnect is up and the organization can ping instances in one subnet, which confirms that Layer 2 and basic Layer 3 connectivity (via the VLAN attachment) are working. However, the inability to reach a service on a different subnet within the same VPC indicates that the on-premises router does not have a route to that specific subnet. This is most likely because the BGP session is not advertising the prefix for that subnet, or the on-premises router is not receiving the route via BGP. Without the route, traffic from on-premises to that subnet will be dropped.

Answer

The MTU is too small.

Answer

The firewall rules are blocking the traffic.

Answer

The VLAN attachment is down.

Question 4

A company with limited public IP addresses on-premises needs to connect to Google Cloud using Cloud VPN. They require high availability. Which solution should they implement?

Accepted Answer

Use HA VPN with two on-premises public IPs and two tunnels.. HA VPN provides high availability by using two tunnels, each terminating on a separate on-premises VPN gateway with a unique public IP address. This ensures that if one on-premises public IP or tunnel fails, traffic can still flow through the other tunnel, meeting the high-availability requirement. Classic VPN (option B) does not support active-active failover, and using the same public IP for both tunnels (option D) creates a single point of failure at the on-premises side.

Answer

Use NAT to map multiple private IPs to one public IP.

Answer

Use Classic VPN with a single tunnel.

Answer

Use HA VPN with the same public IP for both tunnels.

Question 5

When setting up a Partner Interconnect, which Google Cloud resource is used to connect to the partner's network?

Accepted Answer

VLAN attachment. When setting up a Partner Interconnect, the correct Google Cloud resource is a VLAN attachment. This attachment is provisioned on a Cloud Interconnect connection that is managed by a supported service provider, and it defines the VLAN and the Cloud Router configuration used to exchange routes via BGP. The VLAN attachment is the logical construct that connects your VPC network to the partner's network through the partner's physical infrastructure.

Answer

Cloud VPN gateway

Answer

Cloud Interconnect attachment

Answer

Cloud Router

Question 6

A customer has established a Dedicated Interconnect, but traffic from on-premises to Google Cloud is still using the internet path instead of the interconnect. What is the most likely cause?

Accepted Answer

The BGP routes from on-premises have a lower priority than the default route via internet.. Google Cloud uses route priority to determine which route is used when multiple routes match a destination. The default route (0.0.0.0/0) is a system route with priority 0 (highest priority). BGP routes learned via Dedicated Interconnect have a priority of 200 (lower priority). When both exist, the route with the lower priority number (higher priority) wins, so the default route via the internet takes precedence over the BGP routes from the interconnect. This causes traffic to use the internet path instead of the interconnect.

Answer

The on-premises firewall blocks BGP traffic.

Answer

The Google Cloud Router has not learned any routes.

Answer

The VLAN attachment is in a different region.

Question 7

An organization uses HA VPN with dynamic routing and active-active BGP sessions. One tunnel fails, but traffic continues to flow through the other tunnel. However, they notice increased latency. What is the most likely explanation?

Accepted Answer

BGP multipath is enabled, causing all traffic to be sent through the remaining tunnel.. When BGP multipath is enabled on an HA VPN with active-active BGP sessions, the router can load-balance traffic across multiple tunnels. If one tunnel fails, all traffic is redirected through the remaining tunnel, which can cause increased latency due to congestion or suboptimal path selection. The correct answer is A because this behavior directly explains the latency increase after a tunnel failure.

Answer

The remaining tunnel is using a different encryption algorithm.

Answer

The BGP timers are misconfigured.

Answer

The failed tunnel's routes are still in the routing table.

Question 8

A company needs to connect multiple on-premises sites to Google Cloud using a single Cloud VPN gateway. What is the recommended approach?

Accepted Answer

Create multiple VPN tunnels, each with its own BGP session to a Cloud Router.. When connecting multiple on-premises sites to Google Cloud using a single Cloud VPN gateway, the recommended approach is to create multiple VPN tunnels, each with its own BGP session to a Cloud Router. This allows the Cloud VPN gateway to terminate multiple tunnels, and each tunnel can have a unique BGP session for dynamic route exchange, enabling the gateway to learn and advertise routes for each site independently. Using a single tunnel with multiple BGP sessions or policy-based routing is not supported because a Cloud VPN tunnel is a point-to-point connection that can only have one BGP session per tunnel, and static routes would not provide the redundancy or dynamic failover needed for multiple sites.

Answer

Create a single VPN tunnel and use policy-based routing to direct traffic.

Answer

Use a single VPN tunnel with multiple BGP sessions.

Answer

Create a single VPN tunnel and use static routes for each site.

Question 9

A customer reports that after setting up HA VPN, some on-premises subnets are not reachable from Google Cloud. The Cloud Router shows the missing routes. What is the most likely cause?

Accepted Answer

BGP route filters are blocking the advertisement of those subnets.. The Cloud Router shows the missing routes, indicating that the VPN tunnel and BGP session are up, but the routes are not being installed. BGP route filters on the Cloud Router or on-premises router can explicitly block the advertisement of specific subnets, preventing them from being learned and installed in the routing table even though the BGP session is established.

Answer

The VPN tunnel is down.

Answer

The on-premises router is not configured to advertise those subnets.

Answer

The shared secret is incorrect.

Question 10

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

Accepted Answer

It depends on the redundancy requirements; typically two per attachment for active-active.. With a Dedicated Interconnect using two VLAN attachments in different edge availability domains (EADs), the recommended best practice for high availability is to establish two BGP sessions per VLAN attachment (one active and one redundant) on the same Cloud Router, resulting in four sessions total. However, the question asks 'how many BGP sessions should be established' and the correct answer acknowledges that it depends on the redundancy requirements; typically two per attachment for active-active, but if active-passive is acceptable, fewer sessions may suffice. This flexibility makes 'It depends' the most accurate choice.

Answer

Four: two per VLAN attachment.

Answer

Two: one per VLAN attachment.

Answer

One: one session per Cloud Router.

Question 11

Which TWO statements about HA VPN are correct?

Accepted Answer

It supports both active-active and active-passive modes.. HA VPN supports both active-active and active-passive modes. In active-active mode, both tunnels forward traffic simultaneously, while in active-passive mode, one tunnel is used as a standby. This flexibility allows HA VPN to meet different high-availability and load-balancing requirements.

Answer

Both VPN gateways must be in the same region.

Answer

It uses IKEv1 by default.

Answer

It supports static routing as well as dynamic routing.

Question 12

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

Accepted Answer

Check the MTU size on the VPN tunnel or interconnect.. An MTU mismatch on the VPN tunnel or interconnect can cause packet fragmentation or drops, leading to BGP session flapping. Cloud Router uses Google's internal infrastructure, and if the MTU is set too low, large BGP update packets may be silently discarded, triggering hold timer expiry and session resets. Checking and adjusting the MTU ensures that BGP packets can traverse the path without fragmentation.

Answer

Delete and recreate the VLAN attachment.

Answer

Revert all BGP routes to static routes.

Answer

Increase the bandwidth of the interconnect.

Question 13

Which THREE components are required to set up a Partner Interconnect connection?

Accepted Answer

A VLAN attachment. A VLAN attachment (option B) is required because it defines the connection between your VPC and the partner's network over a Partner Interconnect, specifying the VLAN ID and IP addressing for the BGP session. Without a VLAN attachment, the Layer 2 and Layer 3 parameters for the interconnect cannot be established.

Answer

A Dedicated Interconnect connection

Answer

A Cloud VPN gateway

Question 14

Your company has a Dedicated Interconnect with two VLAN attachments (vlan-attachment-a and vlan-attachment-b) connected to two different Edge Availability Domains (EADs) in the us-central1 region. Both attachments are associated with a single Cloud Router named 'cr-us-central1'. On-premises, you have two routers (rtr-a and rtr-b) each connected to one VLAN attachment via BGP. The Cloud Router has four BGP sessions: rtr-a (vlan-a), rtr-a (vlan-b), rtr-b (vlan-a), rtr-b (vlan-b) — a full mesh for redundancy. All sessions are established and routes are exchanged. Recently, you added a new on-premises subnet 192.168.100.0/24 and advertised it via BGP from both on-premises routers. However, Google Cloud instances in the VPC cannot reach this subnet. Other on-premises subnets (e.g., 10.0.0.0/8) are reachable. The Cloud Router route table for 'cr-us-central1' shows multiple entries for 192.168.100.0/24, each with different next hops but all with status 'stacked'. There are no BGP route filters configured. What is the most likely cause of the issue?

Accepted Answer

The new subnet 192.168.100.0/24 overlaps with an existing VPC subnet.. When a BGP-learned route overlaps with an existing VPC subnet, Google Cloud treats it as a conflict and marks the route as 'stacked' (i.e., not active). The Cloud Router can learn the route, but it will not be installed in the VPC's effective routes because the VPC subnet prefix takes precedence. Since 192.168.100.0/24 is a private IP range that could easily overlap with a subnet in the VPC, this is the most likely cause.

Answer

The Cloud Router has reached its maximum route limit.

Answer

The BGP routes have incorrect MED values causing a conflict.

Answer

The on-premises routers are not advertising the subnet with a required community tag.

Question 15

A company wants to connect its on-premises data center to Google Cloud. They have a single VPN appliance on-premises and need high availability for the connection. Which architecture provides the most cost-effective high availability solution?

Accepted Answer

Deploy Cloud HA VPN with two interfaces, each with its own external IP address, and configure two tunnels to the on-premises VPN appliance.. Cloud HA VPN provides high availability by using two interfaces with two external IP addresses, and you can configure two tunnels to a single on-premises VPN appliance. This architecture is cost-effective because it uses a single Cloud VPN gateway (HA VPN) and does not require additional infrastructure. Option B is incorrect because a single Classic VPN tunnel does not provide high availability. Option C is incorrect because deploying two Classic VPN gateways is more expensive and still requires multiple tunnels to the same on-premises appliance, but it does not leverage the built-in HA capabilities of HA VPN. Option D is incorrect because Cloud HA VPN requires at least two interfaces (with separate IPs) to provide high availability; a single interface would be a single point of failure.

Answer

Use a single Cloud Classic VPN tunnel with a static route.

Answer

Deploy two Cloud Classic VPN gateways in the same region, each with one tunnel to the on-premises VPN appliance.

Answer

Deploy Cloud HA VPN with one interface and one external IP address, and configure a single tunnel to the on-premises appliance.