PCNE Implementing Hybrid Interconnectivity Practice Question
A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?
⚠ Common exam trap
Google Cloud often tests the misconception that IPsec VPNs are the only way to encrypt traffic over a dedicated connection, but MACsec is the correct choice when the requirement is to minimize overhead and complexity because it operates at Layer 2 with hardware offload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MACsec on the Dedicated Interconnect
MACsec (IEEE 802.1AE) provides Layer 2 encryption on the Dedicated Interconnect link itself, encrypting all traffic between the on-premises router and the Google Cloud edge router without requiring any changes to applications or additional VPN gateways. This meets the encryption requirement with minimal overhead and complexity because MACsec operates transparently at the data link layer, adding negligible latency and no per-packet processing overhead compared to IPsec or TLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable MACsec on the Dedicated Interconnect
Why this is correct
Provides link-layer encryption with minimal overhead.
- ✗
Enable TLS encryption on all applications
Why it's wrong here
Not practical for all traffic; does not encrypt at network layer.
- ✗
Use Cloud VPN over the internet instead of Dedicated Interconnect
Why it's wrong here
Does not use Dedicated Interconnect and may have latency.
- ✗
Establish an IPsec VPN tunnel over the Dedicated Interconnect
Why it's wrong here
Adding an IPsec VPN tunnel over Dedicated Interconnect introduces unnecessary encryption overhead and tunnel management complexity, since Dedicated Interconnect already provides a private, physically isolated link that does not traverse the public internet. The requirement is to encrypt data in transit, but the correct solution—using MACsec on the Interconnect—encrypts at Layer 2 without the IPsec encapsulation and key-exchange overhead. This option is tempting because IPsec VPNs are a standard method for securing internet-based connections, and they would be correct if the company used a VPN over the public internet instead of a Dedicated Interconnect.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.