PCNE Implementing Hybrid Interconnectivity Practice Test 9 — 15 Questions

Question 1

A company is using Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer has created a VLAN attachment of type PARTNER_PROVIDER in Google Cloud. What must the service provider do to complete the connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provide the engineer with a pairing key to attach the VLAN attachment to the interconnect.. For a PARTNER_PROVIDER VLAN attachment, the customer creates the attachment in their project and Google generates a pairing key. The service provider uses that pairing key to attach their PARTNER-type attachment to the customer's attachment, completing the Layer 2 connection.

Answer

Create a VLAN attachment of type PARTNER on their end and associate it with the customer's VLAN attachment.

Answer

Assign a public IP address to the VLAN attachment.

Answer

Configure BGP routing with the customer's on-premises router.

Question 2

A company has two Dedicated Interconnect connections in different metro areas to meet the 99.99% SLA. They want to ensure that traffic uses both connections in an active-active manner. Which three configurations are required? (Choose three.)

Accepted Answer

Configure BGP on both VLAN attachments with equal MED values.. For active-active, you need two VLAN attachments (one per connection), both attached to the same Cloud Router, and you must configure BGP on both attachments with the same route preferences (e.g., equal MED) to enable ECMP.

Answer

Create a single VLAN attachment shared across both connections.

Answer

Set the VLAN attachments to use static routing instead of BGP.

Question 3

A network engineer is troubleshooting a VPN tunnel that is up but not passing traffic. The Cloud Router shows that BGP sessions are established, but routes are not being exchanged. Which two should the engineer check? (Choose two.)

Accepted Answer

Ensure that the firewall rules in the VPC allow traffic from the on-premises IP ranges.. Option A is correct because even when the BGP session is Established, the VPC firewall rules must permit ingress traffic from the on-premises source IP ranges (and typically egress to them) for data to actually flow through the tunnel; missing or overly restrictive firewall rules cause the classic 'tunnel up but no traffic' symptom. Option C is correct because BGP only installs routes that the peer advertises; if the on-premises VPN device is not advertising the correct on-premises prefixes (via its BGP export/network statements), Cloud Router will have no learned routes to program into the VPC, so no traffic can be routed back. Option B is not the issue here since the sessions are already Established, which means the ASN configuration is compatible. Option D is not relevant because a wrong pre-shared key would prevent the IKE/IPsec tunnel from coming up at all, not leave it up with established BGP. Option E is not relevant because VLAN attachments of type PARTNER_PROVIDER apply to Partner Interconnect, not to a Cloud VPN tunnel scenario.

Answer

Verify that the Cloud Router is using the correct ASN.

Answer

Check that the Cloud VPN gateway has the correct pre-shared key configured.

Answer

Confirm that the VLAN attachment is of type PARTNER_PROVIDER.

Question 4

An engineer has set up a Dedicated Interconnect with a VLAN attachment and a Cloud Router BGP session. They can ping the on-premises gateway IP but cannot reach an on-premises subnet 10.0.0.0/24 from a GCE instance. The on-premises router is advertising the subnet via BGP. What is the most likely cause?

Accepted Answer

The GCE instance does not have a route to the on-premises subnet. The GCE instance can ping the on-premises gateway IP because the Cloud Router has a BGP session and the gateway IP is directly reachable via the VLAN attachment. However, to reach the on-premises subnet 10.0.0.0/24, the GCE VPC needs a route for that subnet pointing to the Cloud Router as the next hop. Without an automatically propagated or manually configured route in the VPC, traffic from the GCE instance to 10.0.0.0/24 will be dropped, even though the on-premises router is advertising the subnet via BGP.

Answer

The VLAN attachment is in the wrong region

Answer

The on-premises firewall is blocking ICMP

Answer

The on-premises router is not using the correct BGP AS number

Question 5

An enterprise requires a hybrid connectivity solution that meets a 99.99% SLA. They plan to use Dedicated Interconnect. Which configuration satisfies the SLA requirement?

Accepted Answer

Two Dedicated Interconnect connections in different metro areas with active-active configuration. Google Cloud's 99.99% SLA for Dedicated Interconnect requires two or more connections in different metro areas configured for redundancy. Only this topology provides physically diverse paths so that a single metro-level failure cannot take down both links, which is the condition Google specifies for the 99.99% availability tier.

Answer

Two Partner Interconnect connections from different providers in the same metro area

Answer

Two Dedicated Interconnect connections in the same metro area with active-passive configuration

Answer

Single Dedicated Interconnect connection with two VLAN attachments

Question 6

A company uses High Availability VPN (HA VPN) with two tunnels and BGP to connect to an on-premises network. They notice traffic only flows through one tunnel. They want to ensure both tunnels are used simultaneously. What should they do?

Accepted Answer

Enable equal-cost multipath (ECMP) on the Cloud Router. Cloud Router with HA VPN supports equal-cost multipath (ECMP) when multiple BGP sessions advertise routes with equal MED and equal AS path length. Enabling ECMP on the Cloud Router allows traffic to be load-balanced across both tunnels simultaneously rather than preferring one. This is the correct mechanism to achieve active-active VPN utilization.

Answer

Increase the MED value on the active tunnel to make it less preferred

Answer

Configure both tunnels with the same BGP AS number on the on-premises side

Answer

Configure static routes with equal cost for both tunnels

Question 7

A company wants to resolve on-premises DNS names from Google Cloud VMs. They have a Cloud DNS private zone for their domain and on-premises DNS servers at IP 10.1.1.1 and 10.1.1.2. Which Cloud DNS feature should they use?

Accepted Answer

Outbound DNS forwarding using an outbound forwarding zone. Outbound DNS forwarding allows Cloud DNS to forward queries for on-premises domains to on-premises DNS servers. By creating an outbound forwarding zone for the on-premises domain and configuring an outbound DNS policy, Google Cloud VMs can resolve on-premises names. This is the correct feature for this requirement.

Answer

Inbound DNS policy

Answer

Peering zones

Answer

Managed reverse lookup zones

Question 8

A company is using Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer has created a VLAN attachment of type PARTNER_PROVIDER in Google Cloud. What must the service provider do to complete the connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PARTNER_PROVIDER. For Partner Interconnect with a service provider that offers Layer 3 connectivity and manages the BGP sessions, the correct VLAN attachment type is PARTNER_PROVIDER. This type is used when the service provider handles the BGP peering on behalf of the customer, which matches the scenario. PARTNER is used when the customer manages BGP themselves over a Layer 2 connection.

Answer

PARTNER

Answer

MANAGED

Answer

DEDICATED

Question 9

An engineer configures an HA VPN with two tunnels to an on-premises network using IKEv2 and pre-shared keys. After configuration, the tunnels show as established, but no traffic flows. The Cloud Router BGP sessions are not established. The on-premises firewall logs show IKE packets are being sent but no response. What is the most likely cause?

Accepted Answer

The pre-shared keys do not match. B is correct because the on-premises firewall logs show IKE packets being sent but no response, which indicates that the IKEv2 pre-shared key mismatch causes the IKE authentication phase to fail. Even though the tunnel status shows as established (likely due to a stale or misconfigured status check), the BGP sessions cannot form because the IKE security association (SA) is not fully authenticated, preventing the IPsec SA from being created and thus blocking all traffic, including BGP packets.

Answer

The Cloud Router BGP AS number is duplicated

Answer

The on-premises firewall is blocking UDP port 500

Answer

The VPN tunnel is configured as policy-based instead of route-based

Question 10

An organization has two Dedicated Interconnect connections in an active-passive configuration. They want to make the passive connection active for maintenance. What should they do to fail over traffic?

Accepted Answer

Configure as-path prepending on the active Cloud Router BGP session to make it less preferred. In an active-passive Dedicated Interconnect setup, BGP attributes control path preference. Applying AS-path prepending on the active Cloud Router's BGP session makes that path less preferred, causing traffic to fail over to the passive connection without tearing down the link.

Answer

Shut down the Cloud Router on the active connection

Answer

Set the MED metric to 0 on the active connection

Answer

Delete the VLAN attachment on the active connection

Question 11

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Accepted Answer

Mismatched BGP hold timer values. Option B is correct because BGP hold timers that do not match (or fall below the negotiated keepalive interval) cause the session to time out and reset, producing flapping; the hold time must be at least 3x the keepalive and both peers negotiate the lower value. Option C is correct because an MTU mismatch on the tunnel path causes large BGP UPDATE/KEEPALIVE packets to be dropped or fragmented, so the session repeatedly fails to stay up. Option D is correct because an incorrect MD5/TCP-MD5 authentication password prevents the BGP peers from validating the TCP segment, so the session never stabilizes and flaps. Option A is not correct because a wrong VLAN ID on the VLAN attachment would break Layer 2 reachability entirely, so the tunnel/BGP session would not establish at all rather than flap. Option E is not correct because a duplicate AS number on the on-premises router would cause BGP loop detection and reject the routes, not the intermittent session flapping described.

Answer

Incorrect VLAN ID on the VLAN attachment

Answer

Duplicate AS number on the on-premises router

Question 12

An organization is considering using Partner Interconnect to connect to Google Cloud. They want the service provider to manage the BGP sessions. Which TWO configurations must they choose? (Choose TWO.)

Accepted Answer

Create VLAN attachment of type PARTNER_PROVIDER. Option B is correct because a VLAN attachment of type PARTNER_PROVIDER is used when the service provider, not the customer, manages the BGP sessions on the Cloud Router side, which matches the requirement that the provider manage BGP. Option C is correct because choosing Layer 3 connectivity with the provider means the provider handles the BGP peering and routing, again aligning with the scenario where the provider manages BGP sessions. Option A is incorrect because Layer 2 connectivity leaves BGP configuration and management to the customer, not the provider. Option D is incorrect because a VLAN attachment of type PARTNER is used when the customer manages the BGP sessions, which contradicts the stated requirement. Option E is incorrect because configuring BGP sessions on the Cloud Router is the customer's responsibility in the PARTNER model, whereas the scenario requires the provider to manage BGP.

Answer

Select Layer 2 connectivity option with the provider

Answer

Create VLAN attachment of type PARTNER

Answer

Configure BGP sessions on the Cloud Router

Question 13

A company is deploying a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They require 99.99% availability for the interconnect. Which two actions must they take to meet this SLA?

Accepted Answer

Order two 10 Gbps circuits in different metro areas. To achieve 99.99% availability for Dedicated Interconnect, you need two connections with at least 10 Gbps each, placed in different metropolitan areas (different metro zones). This provides redundancy even if a whole metro area fails.

Answer

Order four 10 Gbps circuits in the same metro area

Answer

Order a single 10 Gbps circuit

Answer

Order two 10 Gbps circuits in the same metro area

Question 14

You are configuring a Cloud Router for a Dedicated Interconnect VLAN attachment. The on-premises BGP AS number is 65001. You want to ensure that traffic from Google Cloud to on-premises prefers the primary attachment over the backup. Which BGP attribute should you configure on the primary Cloud Router to achieve this?

Accepted Answer

Local preference. To influence traffic from Google Cloud to on-premises (outbound from GCP), you need to affect the path selection on the Cloud Router for received routes. Local preference is a well-known BGP attribute used to prefer one path over another when multiple paths are received to the same destination. By setting a higher local preference on the primary Cloud Router for routes received from the primary attachment, the Cloud Router will prefer that path for outbound traffic. MED influences inbound traffic to the advertiser (on-prem to GCP), not outbound from GCP.

Answer

MED (metric)

Answer

AS path prepending

Answer

Weight attribute

Question 15

A network engineer is setting up a HA VPN between GCP and an on-premises network. They want to use route-based VPN with dynamic routing. Which two resources must be created together to form a functional HA VPN tunnel?

Accepted Answer

Two VPN tunnels, each with a BGP session on the same Cloud Router. An HA VPN gateway has two interfaces, each with its own external IP. For each interface, you create a VPN tunnel and attach it to a Cloud Router with a BGP session. The tunnel and BGP session are paired for each interface.

Answer

One VPN tunnel with two BGP sessions

Answer

Two VPN tunnels without BGP sessions

Answer

Two VPN gateways, each with one tunnel and one BGP session