PCNE Implementing Hybrid Interconnectivity — Timed 25 Questions

Question 1

A company has a Hybrid Connectivity setup using Cloud VPN with dynamic routing (BGP). They notice that traffic from their on-premises network to Google Cloud is intermittently dropping. The on-premises BGP speaker is sending routes with a higher local preference (200) than the Google Cloud router (default 100). What is the most likely cause of the intermittent drops?

25 minute time limit — choose an answer to begin.

Accepted Answer

Asymmetric routing is causing traffic to be dropped by stateful firewalls. The on-premises BGP speaker is sending routes with a higher local preference (200) than the default on Cloud Router (100). This makes the on-premises route preferred for return traffic from Google Cloud, but the forward traffic from on-premises may still use the Cloud VPN tunnel. This asymmetry causes stateful firewalls (e.g., on-premises firewall or Google Cloud firewall) to drop packets that do not match an existing session, leading to intermittent drops.

Answer

AS path prepending is causing route flapping

Answer

Cloud Router is not configured for ECMP

Answer

The BGP MED attribute is misconfigured

Question 2

An organization wants to migrate legacy on-premises applications to Google Cloud but must maintain low-latency connectivity for real-time data synchronization. The on-premises data center is in a colocation facility that is not directly served by Google Cloud. Which hybrid connectivity option is most cost-effective while meeting the latency requirement?

Accepted Answer

Partner Interconnect. Partner Interconnect is the most cost-effective option because it provides a dedicated, low-latency connection through a supported service provider that can extend connectivity from the colocation facility to a Google Cloud region. Unlike Dedicated Interconnect, it does not require physical cross-connects in a Google Cloud colocation facility, making it ideal when the on-premises site is not directly served by Google Cloud. It meets the real-time synchronization latency requirement by offering a reliable, high-bandwidth connection with SLA-backed uptime.

Answer

Direct Peering

Answer

Cloud VPN with dynamic routing

Answer

Dedicated Interconnect

Question 3

A company is using Cloud VPN with BGP to connect their on-premises network to Google Cloud. They have two VPN tunnels from two different on-premises VPN gateways to a single Cloud VPN gateway. They notice that during maintenance on one on-premises gateway, traffic fails over to the other tunnel, but after the maintenance, traffic does not fail back. What is the most likely cause?

Accepted Answer

The BGP local preference on the primary tunnel is not higher than the backup tunnel. B is correct because BGP local preference is used to influence outbound traffic path selection. If the primary tunnel's local preference is not higher than the backup tunnel, BGP will not prefer the primary route after the backup session recovers, causing traffic to remain on the backup tunnel. This is a classic BGP route selection behavior where the highest local preference wins.

Answer

Only one VPN tunnel can be active at a time

Answer

Cloud VPN gateway does not support BGP

Answer

The backup tunnel does not have a valid BGP session

Question 4

A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?

Accepted Answer

Enable MACsec on the Dedicated Interconnect. MACsec (IEEE 802.1AE) provides Layer 2 encryption on the Dedicated Interconnect link itself, encrypting all traffic between the on-premises router and the Google Cloud edge router without requiring any changes to applications or additional VPN gateways. This meets the encryption requirement with minimal overhead and complexity because MACsec operates transparently at the data link layer, adding negligible latency and no per-packet processing overhead compared to IPsec or TLS.

Answer

Enable TLS encryption on all applications

Answer

Use Cloud VPN over the internet instead of Dedicated Interconnect

Answer

Establish an IPsec VPN tunnel over the Dedicated Interconnect

Question 5

An enterprise is using a 10 Gbps Dedicated Interconnect between their on-premises data center and Google Cloud. They measure throughput and find it is only 5 Gbps even though there is no congestion. The on-premises router is configured with a single VLAN attachment. What is the most likely cause?

Accepted Answer

The on-premises router does not support full line rate. A single VLAN attachment on a 10 Gbps Dedicated Interconnect means the on-premises router must handle all traffic through one physical interface. If the router lacks the forwarding capacity to process packets at 10 Gbps line rate, throughput will be capped at its maximum switching or routing performance, which in this case is 5 Gbps. This is a common hardware limitation, not a configuration or congestion issue.

Answer

BGP is not configured, causing routing loop

Answer

MTU mismatch between on-premises and Google Cloud

Answer

QoS policy is limiting throughput on Google Cloud side

Question 6

A company is planning to connect multiple VPCs in different regions to their on-premises network using a single Dedicated Interconnect. Which TWO configurations are required to achieve this?

Accepted Answer

Create a Cloud Router in each VPC. Option C is correct because Dedicated Interconnect requires a Cloud Router in each VPC network that will use the interconnect; the Cloud Router provides BGP peering and dynamic route exchange for that VPC, and a single Cloud Router cannot serve multiple VPCs. Option E is correct because each VPC needs its own VLAN attachment (an interconnect attachment) on the Dedicated Interconnect connection, since a VLAN attachment is bound to one VPC network and one Cloud Router; multiple attachments allow multiple VPCs to share the single physical connection. Option A is wrong because a Cloud Router is regional and scoped to a single VPC, so one Cloud Router cannot serve all VPCs. Option B is wrong because Cloud VPN tunnels are not required for Dedicated Interconnect connectivity and would be a separate, redundant solution. Option D is wrong because VLAN attachments are regional resources, not global, so a 'global VLAN attachment' is not a valid configuration.

Answer

Create a single Cloud Router for all VPCs

Answer

Set up Cloud VPN tunnels for regional connectivity

Answer

Use a global VLAN attachment

Question 7

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

Accepted Answer

Confirm that the subnet routes for the instance IP ranges are present in the VPC. Option B is correct because, even when the VLAN attachment IP is reachable, Compute Engine instances are only reachable if the VPC has subnet routes covering the instances' IP ranges; missing or withdrawn subnet routes (for example, due to route advertisement or peering issues) will black-hole traffic to the instances. Option C is correct because VPC firewall rules must explicitly permit ingress traffic from the on-premises source subnets to the instances; if no allow rule matches the source ranges and target instances, packets are dropped even though the VLAN attachment itself is pingable. Option A is not relevant because IAM controls API-level permissions to manage or access resources, not packet-level network connectivity to instances. Option D is incorrect because the VLAN attachment (Cloud Interconnect) IP is not required to be in the same subnet as the instances; the VLAN attachment is a link-layer construct and routing handles reachability. Option E is not the best check here because the scenario states the VLAN attachment IP can already be pinged, which implies the BGP sessions and Cloud Router are functioning and routes are being exchanged.

Answer

Verify that the on-premises network has IAM permissions to access instances

Answer

Ensure that the VLAN attachment IP is in the same subnet as the instances

Answer

Check that BGP sessions are established between Cloud Router and on-premises router

Question 8

A company is using Cloud Interconnect with multiple VLAN attachments. They want to implement traffic shaping to prioritize real-time traffic over bulk transfers. Which THREE actions should they take?

Accepted Answer

Set up Cloud Router with BGP QoS policies to match DSCP values. Option A is correct because Cloud Router supports BGP QoS policies that can match DSCP values, allowing the network to classify and prioritize real-time traffic over bulk transfers across the Interconnect VLAN attachments. Option C is correct because VPC firewall rules can classify traffic based on source and destination, which is a necessary step to identify and separate real-time traffic from bulk transfers before applying prioritization. Option D is correct because DSCP markings must be set on the on-premises routers so that the traffic types are tagged consistently end-to-end, enabling the Cloud Router BGP QoS policies to match those DSCP values. Option B is not correct because Cloud NAT provides outbound internet address translation and port allocation, not traffic shaping or prioritization. Option E is not correct because VPC flow logs are for observability and identifying heavy traffic flows, not for implementing traffic shaping or prioritization.

Answer

Enable Cloud NAT to handle traffic shaping

Answer

Use VPC flow logs to identify heavy traffic flows

Question 9

A large e-commerce company has a hybrid cloud setup with a Dedicated Interconnect between their on-premises data center in Dallas and Google Cloud us-central1 region. They have a single VLAN attachment with a Cloud Router that uses BGP to exchange routes. The on-premises network uses 10.0.0.0/8, and Google Cloud VPC uses 172.16.0.0/16. They recently deployed a new application in us-west1 that uses IP range 172.17.0.0/16. They created a VPC peering between the us-central1 VPC and the us-west1 VPC. On-premises users can reach the us-central1 workloads but cannot reach the us-west1 application. There are no firewall rules blocking traffic. The on-premises router has a default route pointing to the Interconnect. What is the most likely cause of the issue?

Accepted Answer

The Cloud Router does not have routes for 172.17.0.0/16 because VPC peering does not automatically propagate routes to Cloud Router. The issue is that VPC peering does not automatically propagate routes from the peered VPC (us-west1, 172.17.0.0/16) to the Cloud Router that is used for the Dedicated Interconnect. Cloud Router only learns routes that are present in the VPC’s routing table and that are explicitly advertised via BGP. Since VPC peering routes are not automatically imported into the VPC’s dynamic routing table for Cloud Router, the on-premises router never receives a route for 172.17.0.0/16, even though there are no firewall blocks.

Answer

BGP is not configured between Cloud Router and us-west1 VPC

Answer

Firewall rules in us-west1 are blocking traffic from the on-premises IP range

Answer

The Dedicated Interconnect is only available in us-central1 and cannot reach us-west1

Question 10

A company needs to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have a service level agreement that requires 99.99% availability for the connection. What is the minimum number of VLAN attachments they must provision, and how should they be configured to meet this SLA?

Accepted Answer

Two VLAN attachments, each on a different Interconnect. To achieve 99.99% availability for Dedicated Interconnect, you must eliminate single points of failure. A single VLAN attachment on one Interconnect (Option A) provides no redundancy. Google Cloud requires at least two VLAN attachments, each on a different Interconnect (and ideally different edge availability domains), to meet this SLA. This ensures that if one Interconnect or VLAN attachment fails, traffic can fail over to the other, maintaining connectivity.

Answer

One VLAN attachment with a single Interconnect

Answer

Four VLAN attachments on two Interconnects

Answer

Two VLAN attachments on the same Interconnect

Question 11

A company wants to migrate a legacy application to Google Cloud that requires low-latency communication with on-premises databases. The application is latency-sensitive and must use private IP addresses only. Which hybrid connectivity solution should they choose?

Accepted Answer

Partner Interconnect. Partner Interconnect is the correct choice because it provides a dedicated, high-bandwidth connection with low latency, supports private IP addresses, and meets the requirement for latency-sensitive communication with on-premises databases. Unlike other options, it offers a Service Level Agreement (SLA) for uptime and performance, ensuring consistent low-latency connectivity.

Answer

Cloud VPN

Answer

Carrier Peering

Answer

Direct Peering

Question 12

An organization has multiple VPCs in Google Cloud that need to communicate with an on-premises network through a single Dedicated Interconnect. All VPCs are in the same project. What is the most efficient way to enable connectivity from all VPCs to on-premises?

Accepted Answer

Create a Cloud Router per VPC, each with its own VLAN attachment on the same Interconnect. Each VPC requires its own Cloud Router and VLAN attachment to establish a dedicated BGP session over the same Dedicated Interconnect. This allows multiple VPCs in the same project to share a single physical interconnect while maintaining separate Layer 3 routing domains. A single VLAN attachment cannot be shared across VPCs, as each attachment is associated with exactly one Cloud Router and one VPC.

Answer

Create a separate Interconnect for each VPC

Answer

Create a single VLAN attachment and use it for all VPCs

Answer

Use VPC Network Peering to connect VPCs and attach one VPC to Interconnect

Question 13

A network engineer is troubleshooting connectivity between an on-premises network and Google Cloud. The on-premises router has two BGP sessions configured for redundancy with a Cloud Router. The engineer runs the command above. Which issue does the output indicate?

Accepted Answer

The on-premises router is not advertising any routes to the Cloud Router. The output shows that both BGP sessions are established (state = Established), so options A and B are incorrect. However, the 'Received routes' count is 0 for both peers, meaning the on-premises router is not sending any routes to the Cloud Router. This prevents the Cloud Router from learning the on-premises prefixes, breaking connectivity from Google Cloud to on-premises.

Answer

Both BGP sessions are down

Answer

The BGP session for peer-a is down

Answer

The Cloud Router is not advertising any routes to on-premises

Question 14

A company is designing a hybrid network with Partner Interconnect. They need to ensure high availability and meet a 99.99% SLA. Which TWO actions should they take?

Accepted Answer

Provision two Partner Interconnects from different providers or locations. Option A is correct because Google Cloud's 99.99% Partner Interconnect SLA requires redundancy at the interconnect level, and provisioning two Partner Interconnects from different providers or locations eliminates a single point of failure in the physical path. Option B is correct because each interconnect must be paired with its own VLAN attachment (each attachment maps to a distinct interconnect), so creating two VLAN attachments on different interconnects provides the redundant logical connectivity needed to achieve the 99.99% SLA. Option C is not required for the SLA and is a lower-bandwidth contingency, not a redundant high-availability interconnect design. Option D is insufficient because a single VLAN attachment, even with multiple BGP sessions, still shares one physical interconnect and cannot meet the 99.99% availability target. Option E is also insufficient because two VLAN attachments on a single Partner Interconnect still depend on one physical connection, leaving a single point of failure.

Answer

Enable VPN as a backup to the Interconnect

Answer

Create a single VLAN attachment with multiple BGP sessions

Answer

Provision a single Partner Interconnect with two VLAN attachments

Question 15

An organization is using Cloud VPN with dynamic routing and wants to improve failover time between two VPN tunnels. Which THREE configuration changes can help reduce failover time?

Accepted Answer

Set a lower BGP MED value on the primary tunnel. Option A is correct because BGP MED (Multi-Exit Discriminator) is used to influence path preference; setting a lower MED on the primary tunnel makes it the preferred path, so when it fails, traffic can quickly shift to the secondary tunnel. Option C is correct because reducing BGP keepalive and hold timers allows faster detection of a failed peer, which directly shortens failover time. Option E is correct because using multiple VPN tunnels with equal BGP metrics enables ECMP-style load sharing and immediate failover—if one tunnel goes down, traffic continues over the remaining equal-cost tunnels without waiting for BGP reconvergence. Option B is incorrect because increasing the keepalive interval slows failure detection, which would increase failover time. Option D is incorrect because static routes with higher priority than BGP routes would override dynamic routing and prevent BGP from properly failing over between tunnels.

Answer

Increase the BGP keepalive interval to reduce overhead

Answer

Add static routes with a higher priority than BGP routes

Question 16

A company is setting up a Dedicated Interconnect connection between their on-premises network and Google Cloud. They have configured a VLAN attachment and assigned a Cloud Router with BGP sessions. They notice that traffic is being dropped intermittently. The BGP session status shows 'Established' but routes are not being exchanged consistently. What is the most likely cause?

Accepted Answer

Bidirectional Forwarding Detection (BFD) is not enabled on the BGP session. When BFD is not enabled on a BGP session, the BGP keepalive timers (typically 60 seconds) are used to detect failures, which can cause intermittent traffic drops because BGP does not detect link failures quickly enough. With BFD enabled (default interval of 300ms), failures are detected in sub-seconds, preventing route flapping and ensuring consistent route exchange. The 'Established' BGP state with inconsistent route exchange is a classic symptom of BFD being absent, as routes may be withdrawn and re-advertised due to transient link issues that BGP alone cannot react to fast enough.

Answer

The on-premises firewall is blocking BGP port 179

Answer

The Cloud Router has reached the maximum number of routes

Answer

The MTU on the VLAN attachment is set too low

Question 17

A company wants to connect their on-premises network to Google Cloud using a VPN with high availability and 99.99% SLA. They have two Cloud VPN gateways, each with two external IP addresses. Which configuration best meets the high availability requirement?

Accepted Answer

Deploy two Cloud VPN gateways, each with two tunnels to two separate on-premises VPN devices. It meets the 99.99% SLA requirement by deploying two Cloud VPN gateways, each with two tunnels to two separate on-premises VPN devices. This configuration provides both gateway-level redundancy and tunnel-level redundancy, ensuring that if one gateway, tunnel, or on-premises device fails, traffic can failover to another tunnel. Google Cloud's HA VPN requires at least two tunnels per gateway to achieve the 99.99% SLA, and using two separate on-premises devices eliminates the single point of failure on the customer side.

Answer

Deploy two Cloud VPN gateways, each with one tunnel to one on-premises VPN device

Answer

Deploy one Cloud VPN gateway with two tunnels to two separate on-premises VPN devices

Answer

Deploy one Cloud VPN gateway with one tunnel to one on-premises VPN device

Question 18

A network engineer configured a Cloud Router with the BGP configuration shown. The on-premises router (AS 64512) is peering with the Cloud Router (AS 65001) over a Dedicated Interconnect VLAN attachment. The engineer notices that traffic from on-premises to Google Cloud is not being routed via this interconnect as expected. What is the most likely cause?

Accepted Answer

The update-source loopback0 command is invalid for Cloud Router BGP sessions. Cloud Router does not support the `update-source loopback0` command. BGP sessions on Cloud Router must use the primary IP address of the interface that is directly connected to the VLAN attachment; loopback interfaces are not supported for BGP peering. This command would cause the Cloud Router to attempt to source BGP packets from a loopback address that is not reachable by the on-premises router, breaking the BGP session.

Answer

The route-map SET-MED sets the MED attribute incorrectly

Answer

The ebgp-multihop 2 command is not supported on Cloud Router

Answer

The local-preference is set in the outbound direction, which is not allowed

Question 19

A company is planning to migrate workloads to Google Cloud and needs to establish hybrid connectivity with high bandwidth (10 Gbps) and low latency. They also require the ability to scale bandwidth up to 80 Gbps in the future. Which TWO options should they consider?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (B) is correct because it provides a direct physical connection between the company's on-premises network and Google's network at a colocation facility, supporting 10 Gbps per link and scaling to 80 Gbps by adding more 10 Gbps or 100 Gbps circuits, with low latency and high bandwidth. Partner Interconnect (E) is also correct because it lets the company connect through a supported service provider, achieving 10 Gbps and scaling up to 80 Gbps without needing a direct colocation presence, while still offering high bandwidth and low latency. CDN Interconnect (A) is not appropriate because it is designed to optimize content delivery from Google Cloud CDN to ISPs, not to provide general hybrid connectivity. Direct Peering (C) is not suitable because it peers with Google's edge network for public IP traffic rather than providing private, SLA-backed connectivity to VPC networks. Cloud VPN with multiple tunnels (D) is not the best fit because even with multiple tunnels, it does not reliably deliver 10 Gbps or scale to 80 Gbps with the low latency required for this scenario.

Answer

CDN Interconnect

Answer

Direct Peering

Answer

Cloud VPN with multiple tunnels

Question 20

A large enterprise has a multi-site on-premises network with two data centers (DC1 and DC2) connected via a private WAN. They are migrating critical applications to Google Cloud and have established a Dedicated Interconnect at each data center, each with a single VLAN attachment (vlan-attachment-1 from DC1, vlan-attachment-2 from DC2) connected to a single VPC network in us-central1. Each VLAN attachment uses a separate Cloud Router (router-us-central1-dc1 and router-us-central1-dc2) with BGP sessions advertising the same on-premises prefixes. The VPC has auto-mode subnet ranges. They notice that traffic from Google Cloud to on-premises is flowing only through DC1, and when DC1's interconnect fails, traffic fails over to DC2, but after DC1 recovers, traffic does not return to DC1. The on-premises routers are advertising the same prefixes with equal MED values. What is the most likely cause and the best corrective action?

Accepted Answer

Configure the on-premises router at DC1 to set a lower MED value for its advertised routes to make DC1 preferred. With equal MED values from both on-premises routers, Google Cloud's Cloud Routers will prefer the first learned route and stick to it due to the default BGP best-path selection behavior (no tie-breaking based on router ID or other attributes when routes are identical). When DC1's interconnect fails, the route is withdrawn, and traffic fails over to DC2. After DC1 recovers, the route is re-advertised, but Cloud Router does not automatically preempt the existing DC2 route because the BGP best-path selection is stable and does not re-evaluate unless the current best path is withdrawn. Setting a lower MED on DC1's advertised routes makes DC1's route more preferred, ensuring traffic returns to DC1 after recovery.

Answer

Change the VPC routing mode from auto to custom to force route re-evaluation

Answer

Disable the BGP session on DC2's Cloud Router during normal operation and re-enable it only when DC1 fails

Answer

On the Google Cloud Router for DC1, apply a route policy to set a higher local preference for routes learned from DC1