Hybrid connectivity options overview. When a company keeps some computer systems in its own building (on-premises) and runs others in Google Cloud, it needs a secure, reliable way to let them talk to each other. For the PCNE exam, you must understand the different methods available so you can choose the right one based on speed, security, cost, and reliability — a skill that directly maps to real-world network design decisions.
Jump to a section
A simple way to picture Hybrid Connectivity Options Overview
A property developer manages a new housing estate built across a river from the main town. The estate has its own roads, water pipes, and electricity grid, but residents need reliable connections to town services: the hospital, the supermarket, and the main data centre where all their cloud-based smart-home controls are managed. The developer must decide how to bridge these two separate sites.
One option is to dig a private tunnel under the river, laying dedicated cables that only the estate uses. This is like Google Cloud Interconnect — a private, direct physical link between your on-premises network and Google's network, bypassing the public internet. It's fast, secure, and predictable, but expensive to set up and maintain.
Another option is to build a public road bridge that anyone can use, then encrypt all traffic with a strong lockbox. This is like a VPN over the public internet. It uses existing infrastructure (the internet), is cheaper to start, but can suffer from traffic jams and variable speed because it shares the road with everyone else.
The developer might also combine approaches: use the public bridge for everyday browsing and the private tunnel for sensitive data backups. This is like a hybrid setup using Cloud VPN for general traffic and Dedicated Interconnect for critical workloads. The choice depends on budget, how much traffic, and how sensitive the data is. The core idea is always the same: making two separate places behave as one smooth, connected space.
Hybrid connectivity is the art of linking your own physical data centre or office network (often called on-premises, meaning 'on the premises' you own or rent) to a cloud provider's network, like Google Cloud. Think of it as building a permanent, secure phone line between two separate offices so they can share files, databases, and applications as if they were in the same building.
Before cloud computing, all of a company's computer servers lived in a single building or a few data centres controlled by the company. Employees accessed everything through a local network (a Local Area Network or LAN). This was simple but limiting: you could only scale up by buying more hardware, and if the building had a power cut, everything stopped.
Cloud computing changed this by letting companies rent computing power and storage from providers like Google. Now, many companies use a hybrid model: they keep some sensitive or legacy systems on-premises (for security or because they're expensive to move), and run other systems in the cloud (for flexibility and cost savings). The challenge is connecting these two worlds securely and reliably.
There are several methods to achieve hybrid connectivity. The main options are:
Cloud VPN (Virtual Private Network): This creates an encrypted tunnel over the public internet. 'Encrypted' means the data is scrambled so no one else can read it. 'Tunnel' means a secure, logical pathway between two points. It uses existing internet connections, making it the cheapest and quickest option to set up. However, because it relies on the public internet, performance can vary (latency and bandwidth are not guaranteed), and it may not be suitable for very large or time-sensitive data transfers.
Dedicated Interconnect: This provides a direct, private physical connection between your on-premises network and Google's network. A 'physical connection' means actual fibre-optic cables running from your data centre to a Google 'colocation facility' (a shared data centre where Google has equipment). This bypasses the public internet entirely, offering very high bandwidth (up to hundreds of Gbps — gigabits per second), low latency (less delay), and consistent performance. It's much more expensive and requires longer setup (weeks to months).
Partner Interconnect: If you cannot reach a Google colocation facility directly, you can use a supported 'service provider' (like a telecoms or network company) to connect your on-premises network to Google's network. The provider manages the physical link, and you connect through their infrastructure. It's a middle ground between Cloud VPN and Dedicated Interconnect: more reliable than VPN but less expensive and complex than a dedicated physical link.
Cloud NAT (Network Address Translation): This isn't a direct connectivity method, but it's a key supporting technology for hybrid setups. It allows private cloud resources (like virtual machines without public IP addresses) to access the internet for updates or external APIs, while preventing inbound connections from the internet. It's like giving a private building a single shared phone number to call out, without exposing a direct line for others to call in.
Router Appliances (like the Cloud Router): Google Cloud Router uses the Border Gateway Protocol (BGP) to dynamically exchange routing information between your on-premises network and your Virtual Private Cloud (VPC) in Google Cloud. BGP is a standard protocol that lets networks tell each other about the best paths to specific IP addresses. This ensures that if one connection goes down, traffic automatically reroutes through another path (called 'failover'), providing high availability.
Each method has a trade-off. Cloud VPN is cheap and quick, but less reliable and slower. Dedicated Interconnect is fast and reliable, but expensive and slow to deploy. Partner Interconnect sits in the middle. The real skill — and what the exam tests — is mapping business requirements (budget, speed, security, and uptime) to the right connectivity option.
For example, a small startup might use Cloud VPN to connect its office to Google Cloud for development work. A large bank processing millions of financial transactions might need Dedicated Interconnect for guaranteed low latency. A mid-sized company might choose Partner Interconnect to get better reliability than VPN without the full cost of dedicated cables.
Understanding these options is also about knowing when NOT to use a particular method. For instance, you would not use Dedicated Interconnect for a short-term project because the setup time and cost are too high. You would not rely solely on Cloud VPN for a real-time video streaming application because internet congestion could cause delays or drops.
Identify your requirements
Write down the key needs: how much data needs to move (bandwidth), how fast it must arrive (latency), how critical uptime is (availability), and what your budget is. Also note security and compliance requirements (e.g., data must be encrypted in transit). This step defines which connectivity option is suitable.
Choose between Cloud VPN, Partner Interconnect, or Dedicated Interconnect
Based on your requirements, match them to the options: choose Cloud VPN if latency is flexible and bandwidth is under 3 Gbps; choose Partner Interconnect if you need moderate reliability without the cost of direct cables; choose Dedicated Interconnect if you need high consistent performance and can afford the cost and setup time.
Set up the connection
For Cloud VPN, you configure a VPN gateway and a tunnel in Google Cloud, and set up a corresponding VPN device on-premises. For Dedicated Interconnect, you order a physical connection through Google's colocation or through a partner, then configure VLAN attachments. For Partner Interconnect, you work with a supported service provider to set up the link.
Configure routing with Cloud Router and BGP
Regardless of the connectivity method (except static VPN), you use Cloud Router to exchange routes between your on-premises network and Google Cloud using BGP. This ensures traffic uses the best path and automatically fails over if a link goes down, maintaining connectivity.
Apply security controls
Add firewall rules to restrict which traffic flows between networks. If using Dedicated or Partner Interconnect, consider adding IPsec encryption for sensitive data. For Cloud VPN, encryption is built in. Also set up logging and monitoring to track connection health and usage.
Test and monitor
After setup, test the connection by transferring sample data and measuring latency. Set up alerts for high latency, dropped packets, or bandwidth nearing capacity. Regularly review usage to decide if you need to upgrade (e.g., add another Dedicated Interconnect link) or downgrade (e.g., replace a costly link with a cheaper option).
Imagine you are a network engineer at 'MediCorp', a healthcare company that stores patient records in its own data centre for compliance reasons. MediCorp is building a new patient portal application on Google Cloud that needs to query those on-premises records in real time. The portal must work 24/7, be highly secure (medical data cannot be leaked), and performance must be consistent — patients expect the portal to load within seconds.
Your first step is to assess the requirements. The application needs low latency (under 10 milliseconds) and high bandwidth (at least 5 Gbps) because thousands of patients will use it simultaneously. Security is paramount: patient data must be encrypted both in transit (as it moves) and at rest (when stored). Budget is a concern, but reliability (uptime) is non-negotiable.
Based on these requirements, Cloud VPN alone would not suffice. It relies on the public internet, so latency and bandwidth are not guaranteed. On a busy afternoon, delays could cause the portal to time out. Also, Cloud VPN supports up to about 3 Gbps per tunnel, which might be borderline for your needs. However, Cloud VPN is often used as a backup connection because it's cheaper to keep running.
You decide on Dedicated Interconnect. You contact Google and order a 10 Gbps connection. You then work with a colocation provider to bring fibre from your data centre to the nearest Google Cloud colocation facility. This process takes about six weeks because it involves physical cable installation, testing, and configuration.
Once the physical link is active, you configure the following:
Cloud Router: You set up Cloud Router to use BGP to exchange routing information between your on-premises network and your VPC. This ensures that if your Dedicated Interconnect link fails, traffic automatically fails over to a secondary Cloud VPN connection you set up as a backup.
Firewall rules: You create firewall rules in Google Cloud to allow only specific traffic between the two networks — only the patient portal application servers can talk to the on-premises database.
Encryption: Even though Dedicated Interconnect is private and not exposed to the public internet, you configure additional encryption (using IPsec, a standard protocol for securing internet communications) on top for extra security, as required by healthcare regulations.
Monitoring: You set up Cloud Monitoring and Cloud Logging to track the connection's health, latency, and usage. You also configure alerts if the connection drops or if traffic exceeds 80% capacity, so you can plan upgrades before problems arise.
After deployment, your hybrid setup works smoothly. Patient data flows securely and quickly. When a fibre cut happens in the colocation facility (a rare real-world event), the Cloud Router automatically routes traffic over the backup Cloud VPN within seconds, ensuring the patient portal stays online. The only impact is a slight increase in latency temporarily.
In this real scenario, the IT professional's job is not just to turn on a connection, but to design for failure, security, and growth. You need to know when to use Dedicated Interconnect, how to combine it with Cloud VPN for backup, and how to monitor the whole system. You also need to understand costs: Dedicated Interconnect has a monthly fee per 10 Gbps, plus colocation fees, while Cloud VPN has only a small hourly charge. Your choice impacts the company's budget and the experience of millions of patients.
The PCNE exam tests your ability to 'evaluate and choose hybrid connectivity methods' under objective 6.1. This is a scenario-based decision-making topic. You will not be asked to configure the options step-by-step, but to select the correct connectivity method given a specific business or technical scenario.
Common question types include:
Scenario selection questions: The question describes a company's requirements (e.g., 'must have 99.99% uptime', 'needs to transfer 50 TB of data daily', 'has limited budget', 'must comply with data residency laws'), and you choose the best connectivity method from a list. The correct answer is almost always the one that matches the most critical requirement.
Best practice questions: These ask which method is recommended for specific use cases, like 'What should you use to connect an on-premises network to Google Cloud for high-bandwidth, low-latency needs?' The answer is Dedicated Interconnect.
Comparison questions: The exam may ask you to identify differences between Cloud VPN, Partner Interconnect, and Dedicated Interconnect. Common traps include confusing the bandwidth limits (e.g., Cloud VPN has a practical limit of about 3 Gbps per tunnel, while Dedicated Interconnect offers up to 80 Gbps per circuit).
Redundancy and failover questions: A frequent trap is a scenario where a single Dedicated Interconnect link is used without a backup. The correct answer usually requires adding a second connection (either another Dedicated Interconnect or a Cloud VPN) for high availability. Never accept a single point of failure.
Cost vs. performance trade-off questions: The exam loves presenting a scenario where the company has a low budget but needs high reliability. The correct answer is often Partner Interconnect, as it provides better reliability than VPN at a lower cost than Dedicated Interconnect.
Key concepts you must memorise for the exam:
Bandwidth limits: Cloud VPN maximum is about 3 Gbps per tunnel (using HA VPN). Dedicated Interconnect can go up to 100 Gbps per VLAN attachment. Partner Interconnect varies by provider.
Latency: Dedicated Interconnect and Partner Interconnect offer the lowest and most consistent latency. Cloud VPN has variable latency.
SLA (Service Level Agreement): Google Cloud offers a 99.99% uptime SLA for Dedicated Interconnect (with two connections). Cloud VPN has a lower SLA.
Encryption: While Cloud VPN always encrypts traffic by default, Dedicated Interconnect traffic is not encrypted by default (it is private but not encrypted). Many compliance scenarios require encryption on top of Dedicated Interconnect.
Routing: Cloud Router and BGP are used for dynamic routing with Dedicated Interconnect and Partner Interconnect. Static routes can be used with Cloud VPN, but BGP is preferred for automatic failover.
Common traps to watch for:
Trap 1: Choosing Cloud VPN for a high-bandwidth, low-latency need. The correct answer is Dedicated Interconnect or Partner Interconnect.
Trap 2: Thinking Dedicated Interconnect is always the cheapest. It is actually the most expensive to set up.
Trap 3: Forgetting backup connections. Any scenario with a single connectivity method (unless explicitly stated as 'testing' or 'non-critical') is usually wrong.
Trap 4: Confusing Partner Interconnect with Dedicated Interconnect. Partner Interconnect uses a third-party provider; Dedicated Interconnect is direct.
Trap 5: Assuming all connectivity methods support the same bandwidth. Always check the specific numbers given in the scenario.
Hybrid connectivity links your on-premises network to Google Cloud, enabling systems in both locations to communicate as if they were in a single network.
Cloud VPN is the cheapest and fastest to set up but has limited bandwidth (up to ~3 Gbps per tunnel) and variable latency because it travels over the public internet.
Dedicated Interconnect provides a private physical connection for high bandwidth (up to 100 Gbps) and low, consistent latency, but is expensive and takes weeks to provision.
Partner Interconnect offers a middle ground: better reliability than VPN at a lower cost than Dedicated Interconnect, using a third-party service provider.
For high availability, always plan for redundancy: use at least two connections (e.g., two Dedicated Interconnect links or a Dedicated Interconnect plus a Cloud VPN backup) with Cloud Router and BGP for automatic failover.
Traffic over Dedicated Interconnect is private but not encrypted by default; add IPsec encryption if your data requires it for compliance.
The correct connectivity method depends on balancing bandwidth, latency, cost, security, and uptime requirements — there is no single 'best' option for all scenarios.
These come up on the exam all the time. Here's how to tell them apart.
Cloud VPN
Traverses the public internet using encrypted tunnels
Bandwidth limited to ~3 Gbps per tunnel
Setup takes hours to days; low upfront cost
Dedicated Interconnect
Uses a private physical fibre cable, bypassing the internet
Bandwidth up to 100 Gbps per circuit
Setup takes weeks to months; high upfront cost
Partner Interconnect
Connection through a third-party service provider
Bandwidth varies by provider, typically up to 10 Gbps
Lower cost than direct physical cable; moderate setup time
Dedicated Interconnect
Direct physical connection to Google colocation facility
Bandwidth up to 100 Gbps per circuit
Higher cost; longer setup time
Cloud VPN (with static routes)
Manually configured static routes; no automatic failover
Simpler to set up for small, non-critical workloads
If the tunnel fails, traffic stops until manual intervention
Cloud VPN (with Cloud Router and BGP)
Dynamic routes via BGP; automatic failover
More complex to configure, but essential for high availability
If one tunnel fails, traffic automatically switches to another
Single connectivity method
Single point of failure; if the connection goes down, hybrid network is cut
Lower cost (only one connection to pay for)
Sufficient for non-critical, test, or development environments
Redundant connectivity (two methods)
No single point of failure; network stays up if one link fails
Higher cost (two connections, possibly different types or providers)
Required for production environments with high availability needs
Mistake
Cloud VPN is always slower than Dedicated Interconnect, so you should never use it for production.
Correct
Cloud VPN can be perfectly adequate for many production workloads, especially those with moderate bandwidth needs (under 3 Gbps) and where some latency variation is acceptable. It is also an excellent backup connection for Dedicated Interconnect.
Beginners often assume 'private equals fast and public equals slow,' but many enterprise VPNs with optimised routing can provide very good performance. The real deciding factor is the specific bandwidth and latency requirements, not just the label.
Mistake
Dedicated Interconnect automatically encrypts all traffic, so you don't need additional security.
Correct
Dedicated Interconnect provides a private physical link that is not exposed to the public internet, but the traffic itself is not encrypted by default. For sensitive data, you should still encrypt traffic using IPsec or another encryption method, especially if you need to meet compliance requirements like HIPAA or PCI DSS.
The word 'private' can be misleading. People think private means automatically secure from all threats, but physical access to the cable or the colocation facility could theoretically allow eavesdropping. Encryption is an additional layer of protection.
Mistake
Using Partner Interconnect is the same as using a VPN, just with a fancy name.
Correct
Partner Interconnect provides a dedicated logical connection through a service provider, which is more reliable and offers lower and more consistent latency than a VPN over the public internet. It sits between Cloud VPN and Dedicated Interconnect in terms of performance and cost.
The similarity in names (Partner Interconnect vs. Cloud VPN) can cause confusion. Beginners often think 'if it's not my own cable, it's just a VPN'. But Partner Interconnect gives you a guaranteed bandwidth and SLA from the partner, which is much better than internet-based VPN.
Mistake
You can use one Cloud VPN tunnel to connect your entire on-premises network to Google Cloud.
Correct
A single Cloud VPN tunnel typically has a bandwidth limit of about 3 Gbps. For higher throughput, you need to use multiple tunnels in a load-balanced configuration or switch to Dedicated/Partner Interconnect. Also, for high availability, you should use at least two tunnels with Cloud Router for BGP-based failover.
Many beginners think VPNs are unlimited in speed, but they are constrained by the underlying internet connection and the VPN gateway's capacity. The exam often tests this limit by presenting a scenario requiring more than 3 Gbps, and the correct answer would not be a single Cloud VPN tunnel.
Mistake
Cloud NAT is a connectivity method for hybrid networking, just like Cloud VPN.
Correct
Cloud NAT is not a hybrid connectivity method — it does not connect your on-premises network to the cloud. Instead, it allows private cloud resources to access the internet outbound. Hybrid connectivity methods (VPN, Interconnect) enable bidirectional communication between on-premises and cloud networks.
The word 'NAT' (Network Address Translation) and the fact that it deals with internet access makes beginners think it connects networks. It's actually a way to provide outbound-only internet access to private resources, which is a different function entirely.
Mistake
A Dedicated Interconnect connection is always faster and cheaper than any other option.
Correct
Dedicated Interconnect is faster (low latency, high bandwidth) but is significantly more expensive to set up and maintain compared to Cloud VPN or Partner Interconnect. It is not always the right choice; for small or short-term projects, VPN is more cost-effective.
The assumption that 'more expensive = better for everything' leads to overspending. Cost optimisation is a key skill tested in the exam. Beginners often ignore the trade-off and always pick the technically best option without considering budget.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Cloud VPN is an encrypted tunnel over the public internet — it's cheap and quick to set up but has variable performance. Dedicated Interconnect is a private physical fibre cable directly connecting your network to Google's — it's fast and reliable but expensive and takes weeks to deploy.
It is not recommended because the setup time (weeks) and minimum commitment periods make it costly for short-term use. Cloud VPN or Partner Interconnect are better for temporary or short-lived needs.
No, by default traffic over Dedicated Interconnect is private but not encrypted. If you need encryption (e.g., for compliance), you must add a separate encryption layer like IPsec on top.
A single Cloud VPN tunnel can handle up to approximately 3 Gbps. For higher throughput, you can use multiple tunnels in a load-balanced setup or switch to Dedicated or Partner Interconnect.
Partner Interconnect uses a third-party service provider to connect your network to Google Cloud, offering a dedicated logical connection with a Service Level Agreement. It is more reliable and provides consistent latency compared to a VPN over the public internet.
Cloud Router is a Google Cloud service that uses BGP to dynamically exchange routing information between your on-premises network and your VPC. It enables automatic failover if a connection drops and simplifies route management as your network grows.
Choose Dedicated Interconnect if you can physically connect to a Google colocation facility and need the highest bandwidth and lowest latency. Choose Partner Interconnect if you cannot reach a colocation facility directly or want a slightly cheaper option with still good reliability.
You've finished Hybrid Connectivity Options Overview. Continue through the PCNE study guide to build a complete picture of the exam.
Done with this chapter?