Courseiva

CCNA Implementing Hybrid Interconnectivity Questions

75 of 212 questions · Page 1/3 · Implementing Hybrid Interconnectivity · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A network engineer sees the above output from a Cloud Router. There are two BGP peers from the on-premises router (10.0.0.1 and 10.0.0.2). Both learned the same route 10.1.0.0/16 from their respective peers. However, traffic from Google Cloud to 10.1.0.0/16 is only going through the first peer (10.0.0.1) and not load-balanced. What could be the reason?

A.The on-premises router is advertising the route with different MED values
B.The on-premises router is advertising the route with different AS_PATH lengths
C.The VPC routing mode is set to 'global'
D.Cloud Router has a limit of one route per prefix
AnswerA

Different MED values prevent ECMP; Cloud Router selects the route with the lower MED.

Why this answer

BGP uses the MED (Multi-Exit Discriminator) attribute to influence inbound traffic from a neighboring AS. When the on-premises router advertises the same route (10.1.0.0/16) to the Cloud Router via two peers (10.0.0.1 and 10.0.0.2) with different MED values, the Cloud Router will prefer the route with the lower MED value. This causes all traffic to be sent through the peer with the lower MED, preventing load balancing.

By default, Cloud Router does not perform ECMP (Equal-Cost Multi-Path) for BGP routes unless the paths are identical in all BGP path selection criteria, including MED.

Exam trap

The trap here is that candidates often assume BGP automatically load-balances across multiple peers for the same prefix, forgetting that BGP's path selection algorithm picks a single best path unless all attributes (including MED) are equal, and that MED is compared even when AS_PATH lengths are the same.

How to eliminate wrong answers

Option B is wrong because if the on-premises router advertised the route with different AS_PATH lengths, the Cloud Router would prefer the shorter AS_PATH, which would also result in a single preferred path, not load balancing. However, the question states that both peers learned the same route, implying the AS_PATH lengths are likely equal; the issue is specifically about MED. Option C is wrong because the VPC routing mode (global vs. regional) affects how routes are propagated across regions, not how BGP path selection chooses between two peers in the same region.

Option D is wrong because Cloud Router does not have a limit of one route per prefix; it can learn multiple routes for the same prefix from different BGP peers and can perform ECMP if the routes are equal in all BGP selection criteria.

Practice this question →
2
Drag & Dropmedium

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Troubleshooting starts with tunnel status, then BGP, firewall, routing, and finally connectivity tests.

Practice this question →
3
Multi-Selectmedium

A company wants to use BGP traffic engineering to control how traffic flows between GCP and their on-premises network over two Dedicated Interconnect connections. Which TWO BGP attributes can they use on Cloud Router? (Choose 2.)

Select 2 answers
A.BGP communities
B.MED (Multi-Exit Discriminator)
C.Weight
D.Local preference
E.AS path prepending
AnswersA, B

BGP communities can be used for traffic engineering with Cloud Router.

Why this answer

On Cloud Router, you can set MED (metric) to influence inbound traffic and use AS path prepending (though not directly on Cloud Router; you can influence outbound via MED). Actually, Cloud Router supports setting MED on advertised routes. BGP communities can also be used for tagging routes.

Weight is a Cisco-specific attribute, not available on Cloud Router.

Practice this question →
4
Matchingmedium

Match each VPC firewall rule component to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Determines rule evaluation order (lower number = higher priority)

Specifies ingress or egress traffic

Allow or deny matching traffic

Specifies IP ranges or tags for traffic filtering

Selects VM instances to apply the rule

Why these pairings

Correct matches: Source refers to originating IPs, Destination to target IPs, Action to allow/deny, Direction to ingress/egress. Priority and Protocol are other components with distinct meanings.

Practice this question →
5
MCQmedium

A company uses a shared VPC with multiple service projects. They want to connect their on-premises data center to the shared VPC through a Dedicated Interconnect. Where should they configure the Cloud Router and VLAN attachment?

A.In the same region as the majority of service project instances
B.In the host project of the shared VPC
C.In a global resource policy, cross-project
D.In the service project that will use the connectivity
AnswerB

Host project manages networking for all service projects.

Why this answer

In a shared VPC architecture, the Cloud Router and VLAN attachment for Dedicated Interconnect must be configured in the host project because the host project owns the VPC network and manages all network resources, including interconnect attachments. Service projects consume subnets from the host project but cannot create or manage interconnect resources. This ensures that the on-premises connectivity is centrally managed and that all service projects can use the interconnect through the shared VPC's routing.

Exam trap

Google Cloud often tests the misconception that interconnect resources can be configured in a service project because the service project uses the VPC, but in reality, the host project owns the VPC and all network-level resources like Cloud Routers and VLAN attachments must be created there.

How to eliminate wrong answers

Option A is wrong because the Cloud Router and VLAN attachment are not tied to the region of service project instances; they must be in the host project, and the Cloud Router can be regional or global, but the VLAN attachment is always regional and must be in the same region as the interconnect location, not the majority of instances. Option C is wrong because there is no 'global resource policy, cross-project' for interconnect configuration; Cloud Router and VLAN attachments are always project-scoped resources, and cross-project connectivity is handled via shared VPC host project ownership. Option D is wrong because service projects cannot configure Cloud Router or VLAN attachments; they lack the necessary permissions and the VPC network is not owned by them, so they cannot create interconnect resources in the host project's VPC.

Practice this question →
6
MCQhard

Company A and Company B both have networks in Google Cloud. They want to connect their VPCs using VPC peering, but they have overlapping IP addresses. How can they resolve this?

A.Use Cloud VPN to establish connectivity between the VPCs, as VPC peering cannot handle overlapping IPs.
B.Configure Private Service Connect to connect the VPCs.
C.Configure VPC peering with custom route exchange to exclude the overlapping subnets.
D.Use Dedicated Interconnect to connect the VPCs through a central router.
AnswerA

Cloud VPN can be configured with NAT or traffic selectors to handle overlapping IPs.

Why this answer

VPC peering does not support overlapping IP ranges. The only option from the list that can handle overlapping IPs is Cloud VPN with network address translation or filtering.

Practice this question →
7
MCQmedium

Your company has a Partner Interconnect connection via a service provider that offers Layer 3 connectivity. The provider assigns an IP address on the VLAN attachment. Which VLAN attachment type should you use when creating the attachment in Google Cloud?

A.PARTNER_PROVIDER
B.VPN
C.PARTNER
D.DEDICATED
AnswerC

PARTNER is correct for Layer 3 connectivity where the partner provides IP addresses and routing.

Why this answer

When a service provider offers Layer 3 connectivity and assigns an IP address on the VLAN attachment, you must use the PARTNER attachment type. This type is specifically designed for Partner Interconnect with Layer 3 (routed) connections, where the provider manages the IP addressing and routing. PARTNER_PROVIDER is used for Layer 2 attachments where you assign your own IP addresses.

Exam trap

The Google Professional Cloud Network Engineer exam often tests the distinction between Layer 2 and Layer 3 attachments in Partner Interconnect, trapping candidates who confuse PARTNER_PROVIDER (Layer 2, customer-assigned IPs) with PARTNER (Layer 3, provider-assigned IPs).

How to eliminate wrong answers

Option A is wrong because PARTNER_PROVIDER is used for Layer 2 (VLAN) attachments where you must assign your own IP addresses and manage routing, not for Layer 3 provider-assigned IPs. Option B is wrong because VPN is a separate technology (IPsec tunnels over the internet) and is not a VLAN attachment type for Partner Interconnect. Option D is wrong because DEDICATED is used for Dedicated Interconnect (direct physical connections), not for Partner Interconnect via a service provider.

Practice this question →
8
MCQeasy

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have already ordered a cross-connect from their co-location facility to a Google Point of Presence (PoP). What is the NEXT step to establish the connection?

A.Create a Cloud Router and BGP session
B.Run a ping test to verify connectivity
C.Configure BGP on the on-premises router
D.Create a VLAN attachment in Google Cloud
AnswerD

The VLAN attachment is the next logical step after the physical cross-connect is in place.

Why this answer

After the physical cross-connect is in place, the next step is to create a VLAN attachment in the Cloud Console or via gcloud. The VLAN attachment is the logical construct that represents the connection between the on-premises router and the Cloud Router.

Practice this question →
9
Multi-Selectmedium

A company is planning to connect multiple VPCs in different regions to their on-premises network using a single Dedicated Interconnect. Which TWO configurations are required to achieve this?

Select 2 answers
A.Create a single Cloud Router for all VPCs
B.Set up Cloud VPN tunnels for regional connectivity
C.Create a Cloud Router in each VPC
D.Use a global VLAN attachment
E.Provision a separate VLAN attachment for each VPC
AnswersC, E

Each VPC needs its own Cloud Router to establish BGP sessions.

Why this answer

Each VPC requires its own Cloud Router to establish dynamic routing (BGP) over the Dedicated Interconnect. A Cloud Router is a per-VPC resource that manages BGP sessions and routes for that specific VPC, and since the interconnect is shared, each VPC must have its own router to participate in routing independently.

Exam trap

Google Cloud often tests the misconception that a single Cloud Router or global VLAN attachment can serve multiple VPCs across regions, but in reality, each VPC requires its own regional Cloud Router and VLAN attachment for Dedicated Interconnect.

Practice this question →
10
MCQhard

An organization needs to set up a High Availability VPN (HA VPN) between their on-premises network and Google Cloud. They have created an HA VPN gateway with two interfaces and two external IP addresses. What is the next step to establish a functional VPN tunnel pair?

A.Create a VPN tunnel on interface 0 and use Cloud Router to automatically create the tunnel on interface 1.
B.Create two VPN tunnels, one for each interface, and configure a single BGP session shared between them.
C.Create two VPN tunnels, each with its own BGP session, and peer them with the on-premises VPN device.
D.Create a single VPN tunnel with BGP on interface 0, and use static routing on interface 1.
AnswerC

This is the correct configuration: two tunnels, each with its own BGP session.

Why this answer

HA VPN requires two tunnels (one per interface) to form a pair. Each tunnel requires a separate BGP session to provide redundancy.

Practice this question →
11
Multi-Selecteasy

Which TWO are necessary components for setting up Dedicated Interconnect? (Choose two.)

Select 2 answers
A.A Cloud VPN tunnel for management traffic
B.A QoS policy to ensure bandwidth guarantee
C.A Cloud Router in the same region as the VLAN attachment
D.Two physical interconnect connections for redundancy
E.A VLAN attachment mapped to a VPC
AnswersC, E

Cloud Router handles BGP routing for the interconnect.

Why this answer

A Cloud Router is required in the same region as the VLAN attachment to enable dynamic routing (BGP) between your on-premises network and Google Cloud VPC. The VLAN attachment must be mapped to a VPC to define which VPC network the interconnect circuit connects to, allowing traffic to flow between your on-premises network and Google Cloud resources.

Exam trap

Google Cloud often tests the misconception that Dedicated Interconnect requires a VPN tunnel for management or redundancy, when in fact the VPN tunnel is a separate service for encrypted connectivity and is not a component of Dedicated Interconnect setup.

Practice this question →
12
MCQhard

Refer to the exhibit. The Cloud Router shows one BGP peer as ESTABLISHED and one as IDLE. The best routes show two routes to the same destination with different priorities. What is the most likely reason the IDLE peer is not establishing?

A.The on-premises router is not sending routes for the IDLE peer
B.The IDLE peer has a higher priority route, so it is not needed
C.BGP configuration mismatch between Cloud Router and on-premises router for the IDLE peer
D.The IDLE peer is not configured on the Cloud Router
AnswerC

IDLE state indicates a BGP session issue, typically misconfiguration.

Why this answer

The IDLE state in BGP indicates that the session has not been established, typically due to a configuration mismatch. Since the Cloud Router shows one peer as ESTABLISHED and another as IDLE, the most likely cause is a mismatch in BGP parameters (such as AS number, peer IP, or authentication) between the Cloud Router and the on-premises router for the IDLE peer. This prevents the BGP session from transitioning out of the IDLE state.

Exam trap

Google Cloud often tests the misconception that route advertisement or route priority affects BGP session state, but the IDLE state is strictly a session establishment issue caused by misconfiguration or network reachability problems between the peers.

How to eliminate wrong answers

Option A is wrong because the on-premises router not sending routes does not prevent BGP session establishment; the session can still reach ESTABLISHED state even if no routes are advertised. Option B is wrong because route priority (administrative distance or local preference) affects route selection, not BGP peering state; a higher priority route does not cause a peer to remain IDLE. Option D is wrong because if the IDLE peer were not configured on the Cloud Router, it would not appear in the BGP peer list at all; the fact that it is listed as IDLE indicates it is configured but not establishing.

Practice this question →
13
MCQhard

A company uses High Availability VPN (HA VPN) with two tunnels and BGP to connect to an on-premises network. They notice traffic only flows through one tunnel. They want to ensure both tunnels are used simultaneously. What should they do?

A.Increase the MED value on the active tunnel to make it less preferred
B.Configure both tunnels with the same BGP AS number on the on-premises side
C.Configure static routes with equal cost for both tunnels
D.Enable equal-cost multipath (ECMP) on the Cloud Router
AnswerD

ECMP allows both VPN tunnels to be used simultaneously for traffic engineering.

Why this answer

To use both tunnels simultaneously, ECMP must be enabled in the VPC. By default, HA VPN with BGP uses active-passive if the on-premises router uses a lower local preference for one path. ECMP can be enabled on the Cloud Router.

Practice this question →
14
MCQmedium

An enterprise requires a hybrid connectivity solution that meets a 99.99% SLA. They plan to use Dedicated Interconnect. Which configuration satisfies the SLA requirement?

A.Two Partner Interconnect connections from different providers in the same metro area
B.Two Dedicated Interconnect connections in the same metro area with active-passive configuration
C.Single Dedicated Interconnect connection with two VLAN attachments
D.Two Dedicated Interconnect connections in different metro areas with active-active configuration
AnswerD

Two connections in different metro areas provide geographic redundancy and meet the 99.99% SLA.

Why this answer

Google's 99.99% SLA for Dedicated Interconnect requires two connections, each from a different metro area, configured for active-active or active-passive.

Practice this question →
15
MCQeasy

An organization requires a hybrid connectivity option that offers an SLA of 99.99% availability and supports bandwidth up to 100 Gbps. They are willing to manage their own physical infrastructure in a Google colocation facility. Which connectivity solution should they choose?

A.Cloud VPN with multiple tunnels
B.Dedicated Interconnect
C.Partner Interconnect
D.HA VPN
AnswerB

Direct physical connection with high SLA and bandwidth.

Why this answer

Dedicated Interconnect is the correct choice because it provides a direct, private connection between your on-premises network and Google Cloud, supporting bandwidth up to 100 Gbps (via multiple 10 Gbps or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant attachments. This solution requires you to manage your own physical infrastructure in a Google colocation facility, meeting the organization's requirement for self-managed hardware.

Exam trap

Google Cloud often tests the distinction between Dedicated and Partner Interconnect, where candidates mistakenly choose Partner Interconnect because they overlook the requirement for the organization to manage its own physical infrastructure, assuming any 'Interconnect' option meets the SLA and bandwidth needs.

How to eliminate wrong answers

Option A is wrong because Cloud VPN with multiple tunnels is an internet-based, encrypted connection that does not offer an SLA of 99.99% availability (typically 99.9% at best) and cannot support bandwidth up to 100 Gbps due to per-tunnel throughput limits (e.g., 3 Gbps per tunnel for HA VPN). Option C is wrong because Partner Interconnect relies on a third-party service provider to manage the physical connection, which contradicts the requirement that the organization manages its own physical infrastructure in a Google colocation facility. Option D is wrong because HA VPN, while providing high availability, is still an internet-based VPN solution with a maximum throughput of 3 Gbps per tunnel and does not meet the 100 Gbps bandwidth requirement or the 99.99% SLA.

Practice this question →
16
MCQeasy

An engineer configured a Cloud Router with the above settings. The VPC network has subnets 10.1.0.0/16 and 10.2.0.0/16, as well as subnets 10.3.0.0/16 and 10.4.0.0/16. The on-premises router is only receiving routes for 10.1.0.0/16 and 10.2.0.0/16 but not for 10.3.0.0/16 and 10.4.0.0/16. What is the cause?

A.The BGP session is not established
B.The Cloud Router is in global routing mode, which does not advertise all subnets
C.The Cloud Router is set to custom advertisement mode, and the missing subnets are not included in the advertised IP ranges
D.The on-premises router has a filter that blocks the other routes
AnswerC

Custom mode requires explicit specification of ranges to advertise; only listed ranges are advertised.

Why this answer

When a Cloud Router is configured in custom advertisement mode, it only advertises the specific CIDR ranges explicitly listed in the 'Advertised IP ranges' field. Since the missing subnets (10.3.0.0/16 and 10.4.0.0/16) are not included in that list, they are not propagated via BGP to the on-premises router, even though they exist in the VPC.

Exam trap

Google Cloud often tests the distinction between default advertisement mode (which automatically advertises all VPC subnets) and custom advertisement mode (which requires explicit configuration), leading candidates to overlook the fact that missing routes are due to an incomplete custom list rather than a BGP session issue or routing mode setting.

How to eliminate wrong answers

Option A is wrong because if the BGP session were not established, the on-premises router would receive no routes at all, not just a subset. Option B is wrong because global routing mode (as opposed to regional routing mode) does not affect which subnets are advertised; it only controls the scope of route propagation within Google Cloud, not the BGP advertisement list. Option D is wrong because the question states the on-premises router is 'only receiving routes for 10.1.0.0/16 and 10.2.0.0/16', which matches the advertised IP ranges; a filter on the on-premises router would typically block all or specific routes, but the pattern here points to a missing advertisement on the Cloud Router side.

Practice this question →
17
MCQhard

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. Both connections are active and they want to use both simultaneously for load balancing traffic. They have configured two VLAN attachments each with a Cloud Router and BGP sessions. How should they configure BGP to achieve active-active load sharing?

A.Set different local preference values on the Google Cloud Router
B.Configure the on-premises router to enable ECMP for the BGP routes
C.Use AS path prepending on one connection to make it less preferred
D.Assign different MED values to each connection to influence preference
AnswerB

ECMP on the on-premises router allows it to use both paths equally.

Why this answer

Equal-cost multipath (ECMP) requires that the routes from both connections have the same next-hop attribute and are learned via different BGP sessions. By default, Cloud Router advertises the same routes with the same MED and AS path. To enable ECMP, the on-premises router must be configured to accept multiple equal-cost paths.

The Cloud Router will automatically advertise routes with identical attributes when using separate VLAN attachments, and the on-premises router can then load balance.

Practice this question →
18
MCQhard

A company has two HA VPN tunnels from on-premises to Google Cloud using two separate Cloud Routers for redundancy. The on-premises network uses BGP and advertises a default route to Google Cloud. The company wants to ensure that traffic from Google Cloud to on-premises prefers the primary Cloud Router over the secondary. Which configuration should be applied?

A.Set the primary Cloud Router's BGP IP as the next-hop for all routes on the secondary.
B.Set a lower MED on the primary Cloud Router's BGP session for the default route advertisement.
C.Set a higher LOCAL_PREF on the primary Cloud Router for the default route.
D.Set a shorter AS_PATH on the primary Cloud Router's BGP session.
AnswerC

Higher LOCAL_PREF makes the route more preferred for outbound traffic from Google Cloud.

Why this answer

LOCAL_PREF is a well-known mandatory BGP attribute that is used to influence outbound traffic from an AS. By setting a higher LOCAL_PREF on the primary Cloud Router for the default route, Google Cloud will prefer that path for traffic destined to on-premises, as LOCAL_PREF is evaluated before other attributes like AS_PATH and MED.

Exam trap

The trap here is that candidates often confuse MED (which influences inbound traffic) with LOCAL_PREF (which influences outbound traffic), leading them to incorrectly select Option B, thinking MED can control which path Google Cloud uses to send traffic to on-premises.

How to eliminate wrong answers

Option A is wrong because manually setting the primary Cloud Router's BGP IP as the next-hop on the secondary does not influence BGP path selection; BGP next-hop is used for reachability, not preference, and this configuration would not cause the primary to be preferred. Option B is wrong because MED is a multi-exit discriminator that influences inbound traffic to an AS, not outbound traffic from Google Cloud; it is used by the on-premises router to choose which path to use when multiple paths exist to the same prefix, not by Google Cloud. Option D is wrong because a shorter AS_PATH makes a route more preferred, but this attribute is typically manipulated on the on-premises side to influence Google Cloud's path selection; setting a shorter AS_PATH on the primary Cloud Router would not be effective because AS_PATH is prepended by the router advertising the route, and Google Cloud would see the same AS_PATH length from both routers if they are in the same AS.

Practice this question →
19
MCQmedium

A company has deployed a Dedicated Interconnect with multiple VLAN attachments connected to a single Cloud Router. They want to influence inbound traffic from on-premises to Google Cloud to use a specific attachment for certain prefixes. Which BGP attribute can they manipulate on the on-premises router to achieve this?

A.AS_PATH
B.LOCAL_PREF
C.MED
D.Community tags
AnswerC

MED can be set on routes advertised from on-premises to Google Cloud, influencing which attachment is preferred for those prefixes.

Why this answer

The Multi-Exit Discriminator (MED) attribute is used to influence inbound traffic from on-premises to Google Cloud when multiple paths exist via a Dedicated Interconnect. By setting a lower MED value on the on-premises router for specific prefixes, the Cloud Router will prefer that attachment for those prefixes, as MED is compared first among paths from the same neighboring AS.

Exam trap

Google Cloud often tests the distinction between attributes that influence inbound vs. outbound traffic, and the trap here is that candidates confuse MED (inbound influence) with LOCAL_PREF (outbound influence) or AS_PATH prepending (outbound influence), assuming any attribute can be manipulated on the on-premises router to affect Google Cloud's path selection.

How to eliminate wrong answers

Option A is wrong because AS_PATH is used to influence outbound traffic from Google Cloud to on-premises by prepending AS numbers, not inbound traffic from on-premises to Google Cloud. Option B is wrong because LOCAL_PREF is a well-known mandatory attribute that is only used within a single AS to influence outbound traffic from the local router, and it is not exchanged between ASes, so it cannot be set on the on-premises router to affect Google Cloud's path selection. Option D is wrong because Community tags are used for tagging routes to trigger routing policies (like route filtering or preference) but do not directly influence path selection; they require explicit configuration on the receiving router to interpret them, unlike MED which is a standard BGP attribute compared automatically.

Practice this question →
20
MCQmedium

A customer reports that after setting up HA VPN, some on-premises subnets are not reachable from Google Cloud. The Cloud Router shows the missing routes. What is the most likely cause?

A.The VPN tunnel is down.
B.The on-premises router is not configured to advertise those subnets.
C.BGP route filters are blocking the advertisement of those subnets.
D.The shared secret is incorrect.
AnswerC

Route filters on the Cloud Router or on-premises router can selectively allow or deny routes.

Why this answer

The Cloud Router shows the missing routes, indicating that the VPN tunnel and BGP session are up, but the routes are not being installed. BGP route filters on the Cloud Router or on-premises router can explicitly block the advertisement of specific subnets, preventing them from being learned and installed in the routing table even though the BGP session is established.

Exam trap

The trap here is that candidates often assume missing routes are due to a tunnel or BGP session failure, but Cisco tests the distinction between routes being received (BGP table) versus being installed (routing table), which points to route filtering as the cause.

How to eliminate wrong answers

Option A is wrong because if the VPN tunnel were down, the Cloud Router would not show any routes from the on-premises side, and the BGP session would be down, not just missing specific subnets. Option B is wrong because the on-premises router not advertising those subnets would result in the Cloud Router not seeing those routes at all, but the question states the Cloud Router shows the missing routes, meaning they are present in the BGP updates but not installed. Option D is wrong because an incorrect shared secret would prevent the IPsec tunnel from establishing, causing the BGP session to fail entirely, not just filter specific subnets.

Practice this question →
21
MCQmedium

A network engineer is troubleshooting a Cloud VPN tunnel that is not passing traffic. The tunnel status shows as established, and BGP sessions are up. However, traffic from an on-premises subnet (10.0.1.0/24) to a GCP subnet (192.168.1.0/24) is not working. What should the engineer check first?

A.Verify that the on-premises router is advertising the 10.0.1.0/24 prefix via BGP
B.Ensure that the Cloud Router is configured with the correct BGP ASN
C.Check that GCP has a static route for 10.0.1.0/24 pointing to the VPN tunnel
D.Check GCP firewall rules to allow ingress from 10.0.1.0/24
AnswerA

If the prefix is not advertised, GCP will not have a route to reach it.

Why this answer

Even though the VPN tunnel and BGP session are established, traffic may still fail if the on-premises router is not advertising the on-premises subnet (10.0.1.0/24) to GCP via BGP. Without this advertisement, GCP's Cloud Router has no route to reach that subnet, so return traffic from GCP to on-premises is dropped. The first step in troubleshooting is to verify that the on-premises BGP speaker is sending the correct prefix in its UPDATE messages.

Exam trap

Google Cloud often tests the misconception that a 'tunnel established' and 'BGP up' guarantee traffic flow, but the trap here is that route advertisement via BGP is a separate requirement that must be explicitly verified.

How to eliminate wrong answers

Option B is wrong because the BGP ASN on the Cloud Router is already configured correctly if the BGP session is up; an incorrect ASN would prevent the session from establishing. Option C is wrong because GCP does not require a static route for the on-premises subnet when using dynamic routing (BGP); the route is learned automatically via BGP from the on-premises router. Option D is wrong because firewall rules control ingress traffic into GCP, but if GCP has no route back to 10.0.1.0/24, traffic will be dropped before firewall rules are evaluated; the routing issue must be resolved first.

Practice this question →
22
MCQhard

A network engineer is setting up a Dedicated Interconnect with a 10 Gbps circuit. They need to achieve 99.99% availability SLA. Which of the following configurations meets the SLA requirements?

A.One 10 Gbps circuit and one VPN as backup
B.Two 10 Gbps circuits in different metro areas
C.Single 10 Gbps circuit in one metro area
D.Two 10 Gbps circuits in the same metro area
AnswerB

Two circuits in different metros meet the SLA requirement.

Why this answer

Google Cloud's 99.99% SLA for Dedicated Interconnect requires two connections from two different metro areas (redundant locations). Each connection must be 10 Gbps or more. Active-active or active-passive is acceptable, but the key is two circuits in different metros.

Practice this question →
23
MCQeasy

An organization has two Cloud VPN tunnels from the same on-premises router to a Cloud Router in Google Cloud. Both tunnels are using BGP, and the on-premises router is sending the same routes over both tunnels. The Cloud Router is configured to use 'route propagation' from a VPC network. Which of the following is true regarding route priority?

A.Cloud Router will use both tunnels for load balancing (ECMP) if the routes are identical
B.The tunnel with the lower local preference value will be used
C.The tunnel with the higher BGP MED value will be preferred
D.Only the tunnel with the lowest IP address will be used
AnswerA

With identical BGP routes (same prefix, next hop different, same MED and local preference), Cloud Router will install multiple paths and use ECMP.

Why this answer

When both BGP routes are identical in prefix, AS path, local preference, MED, and other attributes, Cloud Router uses ECMP (Equal-Cost Multi-Path) to load balance traffic across both Cloud VPN tunnels. Route propagation in the VPC network does not alter the BGP best-path selection; it simply injects the learned routes into the VPC routing table. Since the on-premises router advertises the same routes over both tunnels, Cloud Router treats them as equal-cost paths and distributes traffic across both tunnels.

Exam trap

The trap here is that candidates often assume BGP always selects a single best path and ignore that ECMP is enabled when routes are identical, leading them to incorrectly choose options that involve attribute-based tiebreakers like local preference or MED.

How to eliminate wrong answers

Option B is wrong because local preference is a BGP attribute used to influence outbound traffic from the Cloud Router's perspective, but when both tunnels receive the same local preference (default 100), it does not cause one tunnel to be preferred over the other. Option C is wrong because a higher BGP MED value makes a route less preferred, not more; MED is a metric used to influence inbound traffic from the on-premises side. Option D is wrong because Cloud Router does not use the tunnel's IP address as a tiebreaker; it uses BGP attributes and, if all attributes are equal, it will use ECMP rather than selecting a single tunnel.

Practice this question →
24
MCQmedium

Refer to the exhibit. The Cloud Router is connected to two on-premises routers via dedicated interconnect. The on-premises routers advertise the same prefix 10.1.0.0/16. Which on-premises router's route will be preferred by Google Cloud for traffic destined to 10.1.0.0/24? (Assume equal AS path length and MED from on-premises.)

A.The route with lower peer IP address
B.Both routes will be used equally (ECMP)
C.The route from peer with IP 169.254.0.1
D.The route from peer with IP 169.254.1.1
AnswerD

This peer has customLearnedRoutePriority 100, which is lower (more preferred).

Why this answer

Google Cloud Router uses the customLearnedRoutePriority attribute as a tiebreaker when two on-premises routers advertise the same prefix via separate VLAN attachments on Dedicated Interconnect, assuming equal AS path length and MED. The router with the lower customLearnedRoutePriority value is preferred. In this scenario, the peer 169.254.1.1 has a lower priority (e.g., 100) compared to 169.254.0.1's higher priority (e.g., 200).

Therefore, the route from peer 169.254.1.1 is selected.

Exam trap

A common pitfall is to assume that BGP uses the lowest neighbor IP address as a tiebreaker when AS path length and MED are equal. In Google Cloud, however, Cloud Router uses the customLearnedRoutePriority attribute (lower is preferred) for routes learned from different VLAN attachments on Dedicated Interconnect. The priority is configured per VLAN attachment and is independent of the peer IP.

Therefore, the correct answer is not based on the IP address; it depends on which VLAN attachment has the lower priority value. Candidates must recognize that the IP addresses given are just identifiers, and the tiebreaker is a non-standard BGP attribute specific to Google Cloud.

How to eliminate wrong answers

Option A is wrong because Google Cloud Router does not use a lower peer IP address as a tiebreaker; it uses the higher peer IP address. Option B is wrong because ECMP is not applied when the same prefix is received from two different BGP peers on a Cloud Router; a single best path is selected based on deterministic tie-breaking rules. Option C is wrong because 169.254.0.1 is the lower link-local address, and the route from that peer would be rejected in favor of the route from the peer with the higher IP address (169.254.1.1).

Practice this question →
25
MCQhard

A multinational company is migrating workloads to Google Cloud and requires a hybrid connectivity solution between their on-premises data centers in New York and London and Google Cloud regions us-central1 and europe-west1. Each data center has a pair of redundant border routers. The network team has set up a Dedicated Interconnect connection in each Google Cloud region, with two VLAN attachments per region (total 4 attachments). Each VLAN attachment is associated with a separate Cloud Router. The Cloud Routers in us-central1 are configured with BGP sessions to the on-premises routers in New York, and the Cloud Routers in europe-west1 peer with the London routers. The VPC is in 'global' dynamic routing mode. After deployment, traffic from on-premises London to Google Cloud in us-central1 takes a suboptimal path: it goes from London to us-central1 via the internet instead of using the Dedicated Interconnect in europe-west1 and then internal Google Cloud backbone. All BGP sessions are up, and routes are being exchanged. The on-premises routers are advertising all their subnets. The Cloud Routers are learning the on-premises prefixes. What is the most likely cause of this suboptimal routing?

A.The VPC subnets in us-central1 are using smaller prefixes that are not being summarized by the Cloud Router.
B.The on-premises London routers are not receiving routes for the VPC subnets in us-central1, so they send traffic via the internet.
C.The Cloud Router in europe-west1 is prepending AS path for routes coming from us-central1, making them less preferred.
D.The on-premises New York routers are setting a lower MED for routes to us-central1, causing London to deprefer them.
AnswerB

Cloud Router only sends routes for subnets in its own region to its BGP peers; global routing mode does not change this.

Why this answer

The on-premises London routers are not receiving routes for the VPC subnets in us-central1. Since the Cloud Routers in europe-west1 only peer with London, they must advertise the us-central1 VPC subnets to London via BGP. If those routes are missing, London has no path via the Dedicated Interconnect and falls back to the internet.

The VPC is in global dynamic routing mode, so Cloud Routers in both regions learn all VPC subnets, but the europe-west1 Cloud Router must explicitly advertise them to London.

Exam trap

The trap here is that candidates assume global dynamic routing automatically ensures all Cloud Routers advertise all VPC subnets to all on-premises peers, but in reality, each Cloud Router must be explicitly configured to advertise the prefixes it learns from the VPC to its BGP neighbors.

How to eliminate wrong answers

Option A is wrong because smaller prefixes are not the issue; Cloud Routers advertise the exact VPC subnet prefixes learned from the VPC, and summarization is not required for correct routing. Option C is wrong because AS path prepending would make routes less preferred, but the question states all BGP sessions are up and routes are being exchanged; prepending would not cause a complete absence of routes, only a preference change. Option D is wrong because MED is a metric used to influence inbound traffic from a single AS; New York routers setting a lower MED for us-central1 routes would not affect London's routing decisions, as MED is not transitive between different AS paths.

Practice this question →
26
MCQhard

A company has deployed a Cloud VPN tunnel using route-based VPN (using IKEv2) and has configured BGP on the tunnel. The tunnel is up, but the BGP session is not establishing. What is a likely cause?

A.The BGP IP addresses are not reachable over the tunnel
B.IKE version mismatch
C.The pre-shared key is incorrect
D.The Cloud Router is not configured
AnswerA

Even if the tunnel is up, if the BGP IPs are misconfigured or not routed, BGP won't establish.

Why this answer

For route-based VPN tunnels, BGP peering requires that the Cloud VPN gateway and the on-premises router can reach each other's BGP IP addresses. The BGP IPs are typically link-local addresses derived from the tunnel's interface. If the BGP session is not establishing, common issues include incorrect BGP IP configuration, firewall rules blocking BGP (port 179), or the tunnel not passing traffic correctly.

Practice this question →
27
MCQhard

A network engineer is troubleshooting an HA VPN setup between Google Cloud and an on-premises data center. The two tunnels are established, and BGP sessions are up on both tunnels. However, traffic from Google Cloud to the on-premises network is only using one tunnel, even though both BGP sessions are advertising the same routes. What is the most likely cause?

A.The on-premises router is sending different BGP metrics (MED) for the same route on the two BGP sessions.
B.The Cloud Router is not configured for dynamic routing.
C.One of the IPsec tunnels is in a dead state.
D.The on-premises router is setting a higher local preference on one route.
AnswerA

If MED differs, Cloud Router will prefer lower MED, leading to single-path use.

Why this answer

When both BGP sessions are up and advertising the same routes, but traffic only uses one tunnel, the most likely cause is that the on-premises router is sending different Multi-Exit Discriminator (MED) values for the same route on the two BGP sessions. MED is a metric that influences inbound traffic to an AS; a lower MED value is preferred. If one tunnel's BGP update carries a lower MED, Google Cloud's Cloud Router will select that path for all traffic, even though both tunnels are functional.

Exam trap

Google Cloud often tests the distinction between BGP attributes that influence inbound vs. outbound traffic; the trap here is that candidates may confuse MED (inbound metric) with local preference (outbound metric) and incorrectly select Option D, not realizing that local preference set by the on-premises router is not sent to Google Cloud's eBGP peer.

How to eliminate wrong answers

Option B is wrong because Cloud Router is explicitly configured for dynamic routing in an HA VPN setup (BGP sessions are up), so the issue is not a lack of dynamic routing configuration. Option C is wrong because the question states both tunnels are established and BGP sessions are up, so neither IPsec tunnel is in a dead state. Option D is wrong because local preference is used to influence outbound traffic from an AS, not inbound traffic to the on-premises network; Google Cloud's Cloud Router would not consider local preference set by the on-premises router, as local preference is typically only propagated within an AS and not sent to eBGP peers.

Practice this question →
28
MCQeasy

An organization wants to connect their on-premises network to Google Cloud using Partner Interconnect. Which of the following is a requirement that must be met before the partner can provision the connection?

A.The organization must purchase a cross-connect at a colocation facility.
B.The organization must have a Dedicated Interconnect connection already set up.
C.The organization must have a VLAN attachment created and share the pairing key.
D.The organization must have a Cloud Router configured with BGP sessions.
AnswerC

The VLAN attachment and pairing key are required for the partner to provision.

Why this answer

Partner Interconnect requires the customer to create a VLAN attachment in their Google Cloud project and share the generated pairing key with the service provider. The partner uses this key to provision the connection on their side, ensuring the correct mapping to the customer's VPC. Without the VLAN attachment and pairing key, the partner cannot establish the Layer 2 circuit.

Exam trap

Google Cloud often tests the distinction between the prerequisites for Partner Interconnect versus Dedicated Interconnect, trapping candidates who confuse the cross-connect requirement (Dedicated) with the VLAN attachment and pairing key requirement (Partner).

How to eliminate wrong answers

Option A is wrong because purchasing a cross-connect at a colocation facility is a requirement for Dedicated Interconnect, not Partner Interconnect, where the partner manages the physical infrastructure. Option B is wrong because Dedicated Interconnect is a separate product and is not a prerequisite for Partner Interconnect; they are independent connectivity options. Option D is wrong because a Cloud Router with BGP sessions is configured after the VLAN attachment is created and the partner provisions the connection, not as a prerequisite before provisioning.

Practice this question →
29
Multi-Selectmedium

A company is planning to connect their on-premises data center to Google Cloud. They require high bandwidth (10 Gbps) and low latency for real-time data replication. They also want a cost-effective solution that supports burstable traffic. Which TWO connectivity options should they consider? (Choose TWO.)

Select 2 answers
A.Classic VPN (route-based VPN)
B.Cloud VPN (IPsec VPN)
C.Partner Interconnect
D.Dedicated Interconnect
E.Direct Peering
AnswersC, D

Offers flexible bandwidth up to 10 Gbps or more via supported partners, with pay-as-you-go pricing suitable for burstable traffic.

Why this answer

Partner Interconnect (Option C) is correct because it provides dedicated, high-bandwidth connections (up to 10 Gbps per circuit) with low latency, suitable for real-time data replication, and supports burstable traffic through a service provider's network, offering a cost-effective alternative to Dedicated Interconnect for enterprises that need flexibility without full physical infrastructure ownership.

Exam trap

Google Cloud often tests the misconception that Cloud VPN or Classic VPN can meet high-bandwidth, low-latency requirements because they are 'VPNs,' but the trap is that these options lack the dedicated physical infrastructure and SLAs needed for real-time replication, whereas Interconnect options provide guaranteed performance.

Practice this question →
30
Multi-Selectmedium

A company is planning to connect their on-premises network to Google Cloud using Dedicated Interconnect. They require high availability for the connection. Which TWO of the following are recommended by Google for achieving high availability? (Choose two.)

Select 2 answers
A.Use a single Dedicated Interconnect with double the bandwidth
B.Connect to two different edge availability domains in the same POP
C.Order connections from two different service providers
D.Order two Dedicated Interconnect connections in the same metro
E.Connect to two different Interconnect locations (POPs)
AnswersD, E

Two connections provide link redundancy, even in the same metro.

Why this answer

Google recommends ordering two Dedicated Interconnect connections in the same metro to provide link-level redundancy. Option E is correct because connecting to two different Interconnect locations (POPs) provides site-level redundancy, protecting against a single POP failure. Together, these two approaches ensure high availability for the hybrid connection.

Exam trap

The trap here is that candidates often confuse 'high availability' with 'increased bandwidth' (Option A) or think that connecting to two edge availability domains in the same POP (Option B) is sufficient, when Google actually requires diversity at the POP level for full high availability.

Practice this question →
31
Multi-Selectmedium

Which TWO are valid methods to allow on-premises traffic to reach Google Cloud resources that only have internal (private) IP addresses? (Choose two.)

Select 2 answers
A.Set up Cloud VPN or Interconnect and configure proper routing and firewall rules.
B.Assign public IP addresses to the resources and use firewall rules to allow on-premises traffic.
C.Use Cloud NAT to allow inbound connections from on-premises.
D.Use the default internet gateway route for the VPC.
E.Configure Private Google Access for on-premises hosts.
AnswersA, E

VPN/Interconnect provide direct connectivity to private IPs from on-premises.

Why this answer

Cloud VPN or Interconnect creates a secure, private connection between on-premises and Google Cloud VPCs. By configuring proper routing (e.g., custom static routes or BGP) and firewall rules, on-premises traffic can reach internal-only IP addresses without needing public IPs, as the traffic traverses the private network path.

Exam trap

Google Cloud often tests the misconception that Cloud NAT can handle inbound connections, but it only supports outbound SNAT/DNAT for outbound traffic, not inbound-initiated connections from on-premises.

Practice this question →
32
MCQmedium

A company has a Hybrid Connectivity setup using Cloud VPN with dynamic routing (BGP). They notice that traffic from their on-premises network to Google Cloud is intermittently dropping. The on-premises BGP speaker is sending routes with a higher local preference (200) than the Google Cloud router (default 100). What is the most likely cause of the intermittent drops?

A.AS path prepending is causing route flapping
B.Asymmetric routing is causing traffic to be dropped by stateful firewalls
C.Cloud Router is not configured for ECMP
D.The BGP MED attribute is misconfigured
AnswerB

Higher local preference can cause asymmetric routing, leading to stateful firewall drops.

Why this answer

The on-premises BGP speaker is sending routes with a higher local preference (200) than the default on Cloud Router (100). This makes the on-premises route preferred for return traffic from Google Cloud, but the forward traffic from on-premises may still use the Cloud VPN tunnel. This asymmetry causes stateful firewalls (e.g., on-premises firewall or Google Cloud firewall) to drop packets that do not match an existing session, leading to intermittent drops.

Exam trap

Google Cloud often tests the misconception that BGP attributes like local preference only affect inbound traffic, when in fact local preference influences outbound path selection from the router's perspective, and a mismatch between on-premises and cloud can cause asymmetric routing that stateful firewalls drop.

How to eliminate wrong answers

Option A is wrong because AS path prepending is used to influence inbound route selection by artificially lengthening the AS path, not to cause route flapping; route flapping is typically due to unstable BGP sessions or route withdrawals, not local preference manipulation. Option C is wrong because ECMP (Equal-Cost Multi-Path) is unrelated to the issue; the problem is asymmetric routing due to local preference mismatch, not load balancing across multiple paths. Option D is wrong because MED (Multi-Exit Discriminator) is used to influence inbound traffic from a neighboring AS, not outbound path selection within the same AS; the local preference mismatch is the direct cause of the asymmetry.

Practice this question →
33
MCQmedium

An organization has multiple VPCs in Google Cloud that need to communicate with an on-premises network through a single Dedicated Interconnect. All VPCs are in the same project. What is the most efficient way to enable connectivity from all VPCs to on-premises?

A.Create a separate Interconnect for each VPC
B.Create a single VLAN attachment and use it for all VPCs
C.Create a Cloud Router per VPC, each with its own VLAN attachment on the same Interconnect
D.Use VPC Network Peering to connect VPCs and attach one VPC to Interconnect
AnswerC

Each VPC gets its own Cloud Router and VLAN attachment, allowing all to use the same Interconnect.

Why this answer

Each VPC requires its own Cloud Router and VLAN attachment to establish a dedicated BGP session over the same Dedicated Interconnect. This allows multiple VPCs in the same project to share a single physical interconnect while maintaining separate Layer 3 routing domains. A single VLAN attachment cannot be shared across VPCs, as each attachment is associated with exactly one Cloud Router and one VPC.

Exam trap

The trap here is that candidates assume a single VLAN attachment can be shared across multiple VPCs, but in Google Cloud, each VLAN attachment is a per-VPC resource that requires its own Cloud Router and BGP session.

How to eliminate wrong answers

Option A is wrong because creating a separate Interconnect for each VPC is unnecessary and cost-inefficient; a single Dedicated Interconnect can support multiple VLAN attachments. Option B is wrong because a single VLAN attachment is tied to one Cloud Router and one VPC; it cannot be used directly by multiple VPCs. Option D is wrong because VPC Network Peering does not extend the Interconnect connectivity; peering only allows communication between VPCs, but the on-premises network would still only be reachable from the VPC that has the VLAN attachment, unless additional routing is configured.

Practice this question →
34
MCQmedium

A company is setting up a Dedicated Interconnect connection between their on-premises network and Google Cloud. They have configured a VLAN attachment and assigned a Cloud Router with BGP sessions. They notice that traffic is being dropped intermittently. The BGP session status shows 'Established' but routes are not being exchanged consistently. What is the most likely cause?

A.Bidirectional Forwarding Detection (BFD) is not enabled on the BGP session
B.The on-premises firewall is blocking BGP port 179
C.The Cloud Router has reached the maximum number of routes
D.The MTU on the VLAN attachment is set too low
AnswerA

Without BFD, BGP may remain Established while the data plane is down, causing dropped traffic.

Why this answer

When BFD is not enabled on a BGP session, the BGP keepalive timers (typically 60 seconds) are used to detect failures, which can cause intermittent traffic drops because BGP does not detect link failures quickly enough. With BFD enabled (default interval of 300ms), failures are detected in sub-seconds, preventing route flapping and ensuring consistent route exchange. The 'Established' BGP state with inconsistent route exchange is a classic symptom of BFD being absent, as routes may be withdrawn and re-advertised due to transient link issues that BGP alone cannot react to fast enough.

Exam trap

Google Cloud often tests the misconception that a BGP session in 'Established' state guarantees stable route exchange, but the trap here is that BFD is required for fast failure detection in cloud interconnect scenarios, and its absence causes intermittent route flapping that does not break the BGP session itself.

How to eliminate wrong answers

Option B is wrong because if the on-premises firewall were blocking BGP port 179, the BGP session would never reach the 'Established' state; it would remain in 'Active' or 'Idle'. Option C is wrong because the Cloud Router maximum route limit (1000 routes by default, expandable) would cause routes to be rejected, not intermittent exchange; the BGP session would still show 'Established' but routes would be missing entirely, not inconsistently exchanged. Option D is wrong because a low MTU on the VLAN attachment would cause packet fragmentation or drops for large packets, but BGP route exchange uses small packets (typically 4096 bytes max for BGP updates) and would not cause intermittent route exchange; MTU issues manifest as connectivity failures for data traffic, not BGP route flapping.

Practice this question →
35
Multi-Selecthard

Which THREE are true regarding Cloud HA VPN when used with dynamic routing (BGP)? (Choose three.)

Select 3 answers
A.Cloud HA VPN requires two Cloud Routers in the same region for redundancy.
B.Cloud HA VPN allows custom BGP timers.
C.Cloud HA VPN requires two interfaces per VPN gateway.
D.Cloud HA VPN BGP sessions use link-local addresses (169.254.x.x).
E.Cloud HA VPN supports using multiple tunnels for ECMP.
AnswersC, D, E

Each HA VPN gateway has two external interfaces for redundancy.

Why this answer

Cloud HA VPN requires two interfaces per VPN gateway to provide high availability and redundancy. Each gateway interface connects to a separate Cloud Router, enabling active-active failover and ensuring continuous connectivity if one interface or tunnel fails.

Exam trap

Google Cloud often tests the misconception that Cloud HA VPN requires multiple Cloud Routers for redundancy, when in fact it uses multiple interfaces on a single Cloud Router, and that custom BGP timers are allowed, whereas Google Cloud enforces fixed timers for stability.

Practice this question →
36
MCQhard

A company has two Dedicated Interconnects in different metro regions connecting to Google Cloud. They want to use BGP communities to influence Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises. Which community action can they apply on the on-premises routers?

A.Set BGP community 2:100 on routes to indicate MED change
B.Set BGP community 0:100 on routes to mark them as high preference
C.Set BGP community 79ba:100 on routes from the preferred interconnect
D.Set BGP community 79ba:101 on routes from the preferred interconnect
AnswerC

The community 79ba:100 (lowest RTT) is supported by Google's Cloud Router to influence route preference for outbound traffic.

Why this answer

Google Cloud uses 16-bit ASN format for BGP communities, and the well-known community 79ba:100 (equivalent to 31210:256 in decimal) is a Google-defined community that sets a higher local preference on routes received from the preferred interconnect. This influences Cloud Router's route selection to prefer the closer interconnect for outbound traffic to on-premises, as higher local preference is evaluated before MED or AS-path length.

Exam trap

Google Cloud often tests the specific Google-defined BGP community format (79ba:xxxx) and its meaning, so candidates may confuse it with standard 2-byte communities or assume any community value works, leading them to pick generic options like 2:100 or 0:100.

How to eliminate wrong answers

Option A is wrong because BGP community 2:100 is not a Google-defined community; Google uses communities in the 79ba:xxxx range (31210:xxxx decimal) for route preference, and MED is not directly set via communities in this context. Option B is wrong because community 0:100 is not a valid Google-defined community; Google uses 79ba:100 for high preference, and community 0:100 has no meaning in Google Cloud's BGP implementation. Option D is wrong because community 79ba:101 is used to set a medium preference (lower than 79ba:100), not the highest preference; using it would not make the preferred interconnect the most preferred path.

Practice this question →
37
MCQeasy

You are designing a hybrid network using Cloud VPN with dynamic routing (BGP) to connect multiple on-premises sites to Google Cloud. What is a best practice to avoid asymmetric routing when you have multiple VPN tunnels from different on-premises routers?

A.Use static routes instead of BGP to have precise control over path selection
B.Use a different BGP ASN for each on-premises router to ensure uniqueness
C.Configure all on-premises routers with the same BGP ASN and enable ECMP on the Cloud Router
D.Disable ECMP on the Cloud Router to avoid multipath issues
AnswerC

Same ASN allows multiple sessions to be treated as redundant, and ECMP load balances traffic.

Why this answer

Using the same BGP ASN on all on-premises routers and enabling ECMP on the Cloud Router allows the Cloud Router to treat multiple BGP sessions as equal-cost paths. This prevents asymmetric routing by ensuring that return traffic can be load-balanced across any available tunnel, while the same ASN avoids BGP loop-prevention mechanisms that would otherwise reject routes from routers with different ASNs.

Exam trap

The trap here is that candidates mistakenly think different ASNs are required for redundancy, but in fact, using the same ASN is necessary to allow ECMP and avoid BGP loop prevention rejecting routes from multiple on-premises routers.

How to eliminate wrong answers

Option A is wrong because static routes lack dynamic failover and cannot adapt to topology changes, leading to potential black-holing or asymmetric routing when tunnels go down. Option B is wrong because using different BGP ASNs on each on-premises router would cause the Cloud Router to see each path as a separate eBGP route, and the BGP best-path selection would prefer one path over the other, preventing ECMP and potentially causing asymmetric routing. Option D is wrong because disabling ECMP forces the Cloud Router to select a single best path, which can still result in asymmetric routing if the selected path differs from the path used by the on-premises router for return traffic.

Practice this question →
38
MCQmedium

A network engineer is configuring an HA VPN tunnel pair between an on-premises VPN device and Google Cloud. The engineer wants to use IKEv2 with pre-shared keys. After configuring both ends, the tunnels do not come up. The engineer sees 'IKE SA negotiation failed - no proposal chosen' in the logs. What is the most likely cause?

A.The encryption algorithm (e.g., AES256) or DH group (e.g., 14) does not match between the two ends.
B.The on-premises device is behind NAT and the VPN gateway does not support NAT traversal.
C.The IKE version on the on-premises device is set to IKEv1 while Cloud VPN expects IKEv2.
D.The pre-shared keys on both ends are different.
AnswerA

This is the classic cause of 'no proposal chosen' – the parameters for the IKE SA do not match.

Why this answer

This error typically indicates a mismatch in IKE proposal parameters such as encryption algorithm, integrity algorithm, DH group, or SA lifetime.

Practice this question →
39
MCQmedium

A company is using Partner Interconnect to connect their data center to Google Cloud. They notice that traffic from their on-premises network to a specific subnet in VPC is taking a suboptimal path. Which action should they take to influence the routing preference?

A.Use route priorities on the Cloud Router for the learned routes.
B.Change the VLAN attachment's mode to active-active.
C.Set a lower cost on the Cloud Router interface for the preferred VLAN attachment.
D.Configure BGP MED values on the on-premises router for the prefixes advertised to the Cloud Router.
AnswerD

MED influences the Cloud Router's path selection, giving preference to lower MED.

Why this answer

BGP MED (Multi-Exit Discriminator) is the standard mechanism for influencing inbound traffic path selection when multiple connections exist between two autonomous systems. By setting a lower MED value on the on-premises router for prefixes advertised to the Cloud Router, the on-premises network can signal Google Cloud to prefer that specific VLAN attachment for traffic destined to the subnet, thereby correcting the suboptimal path.

Exam trap

The trap here is that candidates often confuse influencing inbound vs. outbound traffic and incorrectly choose options that affect Cloud Router's outbound path selection (like route priorities or interface cost) instead of using BGP MED to influence the on-premises router's advertisement.

How to eliminate wrong answers

Option A is wrong because route priorities on Cloud Router affect the selection among multiple learned routes for the same prefix within Google Cloud, but they do not influence the path that on-premises routers use to send traffic into Google Cloud; route priorities are for outbound traffic from Google Cloud. Option B is wrong because changing the VLAN attachment's mode to active-active affects high availability and load balancing of traffic across multiple attachments, but it does not influence routing preference or path selection for inbound traffic. Option C is wrong because setting a lower cost on the Cloud Router interface influences the outbound traffic path from Google Cloud to on-premises (via BGP cost metrics), not the inbound path from on-premises to Google Cloud; the question concerns traffic from on-premises to a subnet in VPC, which is inbound to Google Cloud.

Practice this question →
40
MCQhard

A company has two Dedicated Interconnect connections in the same metro area to meet the 99.99% SLA. One connection is active and the other is passive. During a maintenance window, the active connection goes down. The engineer expects traffic to fail over to the passive connection, but it does not. What is the most likely reason?

A.The SLA requires two circuits in different metro areas for failover.
B.The on-premises router is not configured to use the passive connection.
C.The passive connection is in a different metro area, causing higher latency.
D.The passive VLAN attachment does not have BGP session configured with Cloud Router.
AnswerD

Without BGP session, the passive connection has no routes to receive traffic. The VLAN attachment must be created and a BGP session established, even if the routes are less preferred via MED.

Why this answer

For failover to work with active-passive, the passive connection must have its own VLAN attachment and Cloud Router BGP session with the same routes, but with a higher MED value to be less preferred. If the VLAN attachment is not created, there is no path.

Practice this question →
41
MCQmedium

A company is deploying a Global Cloud VPN with multiple tunnels from different Cloud Router instances to the same on-premises peer. The on-premises BGP speaker is configured with multiple peers. How should they configure the BGP ASN on the Cloud Routers to ensure optimal routing?

A.Use different private ASNs for each Cloud Router to differentiate the tunnels.
B.Use the same private ASN for all Cloud Routers in the same region.
C.Assign a unique public ASN to each Cloud Router.
D.Use the same ASN across all Cloud Routers globally.
AnswerB

Same private ASN ensures the on-premises router treats all Cloud Router peers from the same region as one entity, preventing loops and allowing ECMP.

Why this answer

Using the same private ASN on all Cloud Routers in the same region allows the on-premises BGP speaker to treat multiple tunnels from that region as a single BGP session, enabling load balancing and failover without creating BGP path selection issues. This approach aligns with Google Cloud's recommendation for redundant VPN tunnels, where the same ASN ensures the on-premises router sees the Cloud Routers as a single BGP peer, simplifying routing policy and avoiding unnecessary AS path prepending.

Exam trap

The trap here is that candidates often assume each BGP session needs a unique ASN for redundancy, but in Google Cloud's multi-tunnel VPN design, using the same ASN within a region is required to enable proper load balancing and failover without causing BGP path selection conflicts.

How to eliminate wrong answers

Option A is wrong because using different private ASNs for each Cloud Router would cause the on-premises BGP speaker to treat each tunnel as a separate BGP session, potentially leading to suboptimal routing due to AS path length differences and preventing effective load balancing. Option C is wrong because assigning a unique public ASN to each Cloud Router is unnecessary and wasteful; private ASNs (64512-65534) are sufficient for internal BGP peering, and public ASNs are typically reserved for internet-facing connections, not internal hybrid interconnectivity. Option D is wrong because using the same ASN across all Cloud Routers globally can cause BGP to reject routes from multiple peers with the same ASN if the on-premises router has BGP multi-hop or loop prevention enabled, and it does not account for regional routing policies or failover scenarios where distinct regional ASNs are beneficial.

Practice this question →
42
MCQhard

An organization has a hybrid network with multiple VPN tunnels connecting their on-premises network to Google Cloud. They use Cloud Router with BGP to propagate routes. They recently added a new subnet 192.168.100.0/24 in Google Cloud. On-premises devices can reach resources in the new subnet, but Google Cloud resources cannot initiate traffic to certain on-premises hosts in the 10.0.0.0/8 subnet. BGP sessions are all established. What is the most likely cause?

A.The VPC firewall rules are blocking outbound traffic from the new subnet.
B.The on-premises firewall is blocking traffic initiated from the 192.168.100.0/24 subnet because it is not in the permitted list.
C.There is a route conflict between the 192.168.100.0/24 route and an existing route in the on-premises routing table.
D.The on-premises BGP router is not advertising the 10.0.0.0/8 network because a mask mismatch.
AnswerB

On-premises firewalls often have stateful inspection; new subnet traffic may not be allowed.

Why this answer

The issue is that on-premises hosts in 10.0.0.0/8 can be reached from the new Google Cloud subnet (192.168.100.0/24) because BGP routes are propagated, but return traffic initiated from on-premises hosts is blocked by the on-premises firewall. Since BGP sessions are established and routes are exchanged, the problem is not routing but stateful firewall filtering: the on-premises firewall likely has a rule that permits traffic from known subnets but does not include 192.168.100.0/24, so return packets for connections initiated from Google Cloud are dropped.

Exam trap

Google Cloud often tests the distinction between routing (BGP/route tables) and firewall filtering, leading candidates to incorrectly blame route advertisement or VPC firewall rules when the actual issue is a missing permit entry in the on-premises firewall for the new subnet.

How to eliminate wrong answers

Option A is wrong because VPC firewall rules control traffic entering or leaving Google Cloud resources, but the problem states that on-premises devices can reach the new subnet, so outbound traffic from the new subnet is not blocked; the issue is with traffic initiated from Google Cloud to on-premises. Option C is wrong because a route conflict would cause asymmetric routing or unreachability in both directions, but on-premises devices can reach the new subnet, and BGP sessions are established, so there is no route conflict. Option D is wrong because a mask mismatch would prevent the on-premises BGP router from advertising 10.0.0.0/8, but the problem states BGP sessions are all established and on-premises devices can reach the new subnet, implying the 10.0.0.0/8 route is present in Google Cloud; the issue is with return traffic filtering, not route advertisement.

Practice this question →
43
MCQmedium

An engineer runs the command above to check the status of a Dedicated Interconnect VLAN attachment. The state shows DEFECTIVE. The associated interconnect connection is in ACTIVE state. What is the most likely cause?

A.The VLAN ID is already in use on a different attachment on the same interconnect
B.The Cloud Router is not configured with a BGP session for this attachment
C.The maximum number of VLAN attachments for this interconnect has been exceeded
D.The data center power is down
AnswerA

Duplicate VLAN IDs cause the attachment to be DEFECTIVE.

Why this answer

A Dedicated Interconnect VLAN attachment showing DEFECTIVE state while the interconnect connection itself is ACTIVE indicates a configuration conflict at the VLAN level. The most common cause is that the VLAN ID specified for this attachment is already allocated to another VLAN attachment on the same interconnect, as VLAN IDs must be unique per interconnect. This conflict prevents the attachment from establishing proper Layer 2 connectivity, resulting in a DEFECTIVE state.

Exam trap

Google Cloud often tests the distinction between Layer 2 attachment health and Layer 3 BGP session status — candidates mistakenly assume a BGP misconfiguration causes the attachment to be DEFECTIVE, but the attachment state is independent of BGP and reflects only the VLAN-level connectivity.

How to eliminate wrong answers

Option B is wrong because a missing BGP session on the Cloud Router would cause the BGP session to be down or not established, but the VLAN attachment state would still be ACTIVE (or PENDING) — the attachment itself is a Layer 2 construct and does not depend on BGP configuration for its operational state. Option C is wrong because exceeding the maximum number of VLAN attachments would result in a failure to create the attachment or an error during provisioning, not a DEFECTIVE state on an already-created attachment; the attachment would either be rejected or show a different error. Option D is wrong because a data center power outage would affect the interconnect connection itself, causing it to go DOWN or UNAVAILABLE, not remain ACTIVE while only the VLAN attachment shows DEFECTIVE.

Practice this question →
44
MCQhard

A company with multiple VPCs in a Shared VPC environment wants to connect their on-premises network to all VPCs with high availability and minimal cost. They already have a Dedicated Interconnect. What is the most efficient solution?

A.Set up Cloud VPN with dynamic routing to each VPC.
B.Create an HA VPN gateway for each VPC and peer with on-prem.
C.Use the existing Dedicated Interconnect to create multiple VLAN attachments, one per VPC.
D.Provision a new Partner Interconnect for each VPC.
AnswerC

VLAN attachments allow a single interconnect to connect multiple VPCs efficiently.

Why this answer

A Dedicated Interconnect can support multiple VLAN attachments (each with a separate VLAN ID and BGP session) to connect to different VPCs in a Shared VPC environment. This approach leverages the existing physical connection, provides high availability through redundant attachments, and minimizes cost by avoiding additional circuits or VPN tunnels.

Exam trap

Google Cloud often tests the misconception that a single Dedicated Interconnect can only connect to one VPC, leading candidates to incorrectly choose VPN-based solutions or additional interconnects.

How to eliminate wrong answers

Option A is wrong because Cloud VPN with dynamic routing would require separate tunnels to each VPC, increasing complexity and cost, and it does not utilize the existing Dedicated Interconnect, which is already paid for. Option B is wrong because creating an HA VPN gateway for each VPC duplicates effort and cost; the Dedicated Interconnect can handle multiple VPCs via VLAN attachments without needing separate VPN gateways. Option D is wrong because provisioning a new Partner Interconnect for each VPC would incur significant additional expense and is unnecessary when the existing Dedicated Interconnect can be extended with VLAN attachments.

Practice this question →
45
Multi-Selectmedium

A company is planning a hybrid cloud connectivity strategy with Google Cloud. They need high bandwidth (10 Gbps) and low latency. They also want to avoid internet transit. Which TWO connectivity options meet these requirements? (Choose 2.)

Select 2 answers
A.CDN Interconnect
B.Partner Interconnect
C.Dedicated Interconnect
D.Direct Peering
E.Cloud VPN
AnswersB, C

Provides high bandwidth via a service provider without internet.

Why this answer

Dedicated Interconnect provides direct, high-bandwidth (up to 80 Gbps per circuit) physical connection with low latency, not over the internet. Partner Interconnect also provides high bandwidth via a service provider, often at 1 Gbps or 10 Gbps, and is not internet-based. VPN uses the internet and does not guarantee bandwidth or low latency.

Practice this question →
46
MCQhard

A financial services firm needs to connect their on-premises data center to Google Cloud VPC with 50 Gbps of bandwidth and latency under 5 ms. They are in a metropolitan area with a Google Cloud region. They require an SLA of 99.99% and need to support VLAN attachments to multiple VPCs. Which connectivity option should they choose?

A.Direct Peering
B.Dedicated Interconnect
C.Cloud VPN with multiple tunnels and ECMP
D.Partner Interconnect
AnswerB

Dedicated Interconnect provides up to 100 Gbps per circuit, low latency, 99.99% SLA, and supports multiple VLAN attachments to different VPCs.

Why this answer

Dedicated Interconnect is the correct choice because it provides direct, private connections between the on-premises data center and Google Cloud VPC, supporting up to 80 Gbps per interconnect (via 8 x 10 Gbps links) and offering a 99.99% SLA when configured with redundant links. It supports VLAN attachments (VLANs) to multiple VPCs, enabling segmentation across different environments, and meets the sub-5 ms latency requirement within a metropolitan area with a Google Cloud region.

Exam trap

Google Cloud often tests the misconception that Cloud VPN with ECMP can scale to high bandwidths like 50 Gbps, but in reality, Cloud VPN is limited to 3 Gbps per tunnel and aggregate throughput is constrained by the underlying internet path and encryption overhead.

How to eliminate wrong answers

Option A (Direct Peering) is wrong because it is an ISP-based peering arrangement that does not offer an SLA, does not support VLAN attachments to multiple VPCs, and typically provides best-effort bandwidth without guaranteed 50 Gbps or sub-5 ms latency. Option C (Cloud VPN with multiple tunnels and ECMP) is wrong because Cloud VPN is limited to 3 Gbps per tunnel (even with ECMP, aggregate bandwidth is capped at ~10 Gbps) and does not meet the 50 Gbps requirement; it also lacks a 99.99% SLA. Option D (Partner Interconnect) is wrong because it relies on a third-party service provider, which introduces additional latency and does not guarantee the sub-5 ms latency or the 99.99% SLA that Dedicated Interconnect offers directly.

Practice this question →
47
Multi-Selecthard

A company has two Dedicated Interconnect connections in different metro areas to meet the 99.99% SLA. They want to ensure that traffic uses both connections in an active-active manner. Which three configurations are required? (Choose three.)

Select 3 answers
A.Configure BGP on both VLAN attachments with equal MED values.
B.Create a single VLAN attachment shared across both connections.
C.Set the VLAN attachments to use static routing instead of BGP.
D.Attach both VLAN attachments to the same Cloud Router.
E.Create two VLAN attachments, one for each connection.
AnswersA, D, E

Equal MED allows ECMP to distribute traffic across both connections.

Why this answer

For active-active, you need two VLAN attachments (one per connection), both attached to the same Cloud Router, and you must configure BGP on both attachments with the same route preferences (e.g., equal MED) to enable ECMP.

Practice this question →
48
MCQmedium

A company has set up an HA VPN tunnel between their on-premises router and a Cloud Router in Google Cloud. The on-premises router establishes BGP sessions to both Cloud Router instances, but the routes learned from one Cloud Router instance are not being received. The other instance works fine. What is the most likely cause?

A.The tunnel is in a failed state
B.The on-premises router has incorrect ASN configured for that BGP session
C.The on-premises router has a firewall blocking BGP updates only on one IP address
D.The Cloud Router is set to advertisement mode 'Custom' and does not advertise all subnets
AnswerC

Correct. A firewall blocking BGP updates on one IP address can prevent route reception while allowing session establishment, because the firewall may be configured to block certain traffic after the initial handshake, or it may block the data plane for that specific IP.

Why this answer

The most likely cause is a firewall blocking BGP updates only on one IP address. In Google Cloud HA VPN, each Cloud Router instance uses a separate BGP IP address for the two tunnels. If a firewall on the on-premises router is blocking BGP traffic (TCP port 179) to one of these IP addresses but not the other, BGP sessions can establish (since session establishment uses a different mechanism or the firewall rule is applied incorrectly to the data plane), but BGP updates carrying routes may be dropped.

This explains why one session receives routes while the other does not. An incorrect ASN would prevent BGP session establishment entirely, which contradicts the stem that states BGP sessions are established. Similarly, a failed tunnel would prevent session establishment, and advertisement mode 'Custom' would affect both sessions equally.

Exam trap

Candidates often assume that BGP session establishment guarantees route exchange. In Google Cloud HA VPN, each tunnel has a separate BGP IP address; a firewall blocking updates on one IP can prevent route reception while sessions remain up. This distinction is commonly tested.

How to eliminate wrong answers

Option A is wrong because a failed tunnel would prevent both BGP sessions from working, not just one, and the question states the other instance works fine. Option C is wrong because a firewall blocking BGP updates on only one IP address would typically affect both TCP port 179 traffic and BGP session establishment, but the symptom here is routes not being received, not session failure, and a firewall would likely block the entire session. Option D is wrong because the Cloud Router's advertisement mode being set to 'Custom' would affect both BGP sessions equally, not selectively cause one to not receive routes while the other works.

Practice this question →
49
Multi-Selectmedium

A network engineer is troubleshooting a VPN tunnel that is up but not passing traffic. The Cloud Router shows that BGP sessions are established, but routes are not being exchanged. Which two should the engineer check? (Choose two.)

Select 2 answers
A.Ensure that the firewall rules in the VPC allow traffic from the on-premises IP ranges.
B.Verify that the Cloud Router is using the correct ASN.
C.Verify that the on-premises VPN device is advertising the correct networks to Cloud Router.
D.Check that the Cloud VPN gateway has the correct pre-shared key configured.
E.Confirm that the VLAN attachment is of type PARTNER_PROVIDER.
AnswersA, C

Even with routes, firewall rules must permit the traffic.

Why this answer

Common issues: incorrect firewall rules blocking the traffic, or the route advertisements are not configured correctly (e.g., not advertising the correct prefixes).

Practice this question →
50
MCQhard

Refer to the exhibit. An engineer is troubleshooting a dual-tunnel HA VPN. The BGP session on one interface is established (State/PfxRcd 1) but the other is stuck in Active state. What can cause this?

A.The on-premises router does not have a BGP configuration for the second peer IP address (169.254.x.x).
B.The Cloud Router is using the same BGP identifier for both sessions, causing a conflict.
C.The on-premises router is configured with BGP MD5 authentication that only matches the first peer.
D.The MTU on the second tunnel is not matching between the two ends.
AnswerA

If the on-premises router is not expecting a connection from the second peer IP, it will not respond, leaving the Cloud Router in Active state.

Why this answer

In a dual-tunnel HA VPN, each tunnel uses a separate BGP session with its own peer IP address (typically from the 169.254.x.x link-local range). If the on-premises router only has a BGP neighbor statement for the first peer IP, it will ignore incoming BGP packets from the second peer. The Cloud Router sees the session stuck in Active state because it is sending BGP OPEN messages but never receiving a response, as the on-premises router is not listening on that IP.

Exam trap

Google Cloud often tests the distinction between BGP session states — Active specifically means the TCP connection is not being completed by the remote end, often due to missing neighbor configuration or ACL blocking, not authentication or MTU issues.

How to eliminate wrong answers

Option B is wrong because using the same BGP identifier (router-id) for both sessions is allowed in BGP; it does not cause a session to remain in Active state — it may cause a warning or minor issue but not a stuck Active. Option C is wrong because MD5 authentication mismatch would cause the session to fail authentication and likely show a state of Idle or Connect, not Active; Active means the router is listening for a TCP connection that never completes. Option D is wrong because MTU mismatch does not prevent BGP session establishment; it would cause packet fragmentation or drops after the session is up, not keep it in Active state.

Practice this question →
51
MCQmedium

A company is using Cloud VPN to connect to Google Cloud. They notice that traffic from their on-premises network to Google Cloud is not being routed correctly after a recent change. On the on-premises router, they verify that the BGP session is established and routes are received. Which step should they take next to troubleshoot?

A.Verify that the routes learned via BGP are being propagated to the VPC network by examining Cloud Router details
B.Check the on-premises firewall logs
C.Disable and re-enable the VPN tunnel
D.Check the tunnel status in Cloud Console
AnswerA

Routes learned via BGP must be propagated to the VPC. Cloud Router shows advertised and learned routes.

Why this answer

Since the BGP session is established and routes are received on the on-premises router, the issue is likely that those routes are not being propagated into the VPC network. Cloud Router acts as the BGP speaker for the VPC; even if the VPN tunnel is up and BGP peering is successful, the learned routes must be advertised into the VPC’s routing tables. Verifying Cloud Router details (e.g., using `gcloud compute routers get-status` or checking the Cloud Console) confirms whether the routes are being accepted and propagated, which directly addresses the routing failure.

Exam trap

Google Cloud often tests the misconception that a working BGP session and tunnel status guarantee correct routing, but the real failure point is the propagation of learned routes into the VPC’s routing tables, which requires explicit verification of Cloud Router’s learned routes and advertisements.

How to eliminate wrong answers

Option B is wrong because on-premises firewall logs would only show dropped or allowed packets at the on-premises side, but the problem is about route propagation within Google Cloud, not packet filtering. Option C is wrong because disabling and re-enabling the VPN tunnel is a disruptive, brute-force action that does not diagnose the root cause of route propagation; the tunnel and BGP session are already established. Option D is wrong because checking the tunnel status in Cloud Console only confirms the VPN tunnel is up, but the tunnel is already established and BGP is up, so this provides no insight into why routes are not being used in the VPC.

Practice this question →
52
Multi-Selectmedium

A network engineer is configuring a route-based VPN tunnel between an on-premises network and Google Cloud using Cloud VPN. Which two statements are true about route-based VPN compared to policy-based VPN? (Choose two.)

Select 2 answers
A.Route-based VPNs automatically route traffic based on the routing table entries.
B.Route-based VPNs are less flexible than policy-based VPNs for traffic selection.
C.Route-based VPNs support dynamic routing protocols like BGP.
D.Route-based VPNs require static routes to be configured manually.
E.Route-based VPNs require separate security policies for each traffic flow.
AnswersA, C

Traffic is sent through the tunnel if the destination matches a route that points to the tunnel.

Why this answer

Route-based VPNs use routing tables (like BGP) to determine which traffic is sent through the tunnel, and they support dynamic routing protocols like BGP.

Practice this question →
53
MCQhard

A financial services company is required to encrypt all data in transit between their on-premises data center and Google Cloud. They have a Dedicated Interconnect connection. They want to meet the encryption requirement while minimizing overhead and complexity. Which solution should they implement?

A.Enable MACsec on the Dedicated Interconnect
B.Enable TLS encryption on all applications
C.Use Cloud VPN over the internet instead of Dedicated Interconnect
D.Establish an IPsec VPN tunnel over the Dedicated Interconnect
AnswerA

Provides link-layer encryption with minimal overhead.

Why this answer

MACsec (IEEE 802.1AE) provides Layer 2 encryption on the Dedicated Interconnect link itself, encrypting all traffic between the on-premises router and the Google Cloud edge router without requiring any changes to applications or additional VPN gateways. This meets the encryption requirement with minimal overhead and complexity because MACsec operates transparently at the data link layer, adding negligible latency and no per-packet processing overhead compared to IPsec or TLS.

Exam trap

Google Cloud often tests the misconception that IPsec VPNs are the only way to encrypt traffic over a dedicated connection, but MACsec is the correct choice when the requirement is to minimize overhead and complexity because it operates at Layer 2 with hardware offload.

How to eliminate wrong answers

Option B is wrong because TLS encryption must be implemented per application, requiring application-level changes and configuration, which adds significant complexity and does not encrypt all data in transit (e.g., non-HTTP traffic). Option C is wrong because using Cloud VPN over the internet introduces higher latency, lower reliability, and more operational overhead than Dedicated Interconnect, and it does not leverage the existing dedicated connection. Option D is wrong because establishing an IPsec VPN tunnel over Dedicated Interconnect adds unnecessary encapsulation and encryption overhead at Layer 3, increasing complexity and reducing throughput compared to MACsec's hardware-accelerated Layer 2 encryption.

Practice this question →
54
MCQeasy

What is the maximum number of VLAN attachments that can be configured on a single 10 Gbps Dedicated Interconnect connection?

A.16
B.4
C.2
D.8
AnswerD

8 VLAN attachments per 10 Gbps interconnect.

Why this answer

A single 10 Gbps Dedicated Interconnect connection supports a maximum of 8 VLAN attachments. This limit is defined by Google Cloud's interconnect architecture, where each VLAN attachment consumes a portion of the 10 Gbps bandwidth and is mapped to a unique VLAN ID. The 8-attachment cap ensures predictable performance and avoids oversubscription on the physical link.

Exam trap

The trap here is that candidates often confuse the VLAN attachment limit for Dedicated Interconnect with the higher limits of Partner Interconnect or assume the limit scales linearly with bandwidth, leading them to select 16 or 2 instead of the correct 8.

How to eliminate wrong answers

Option A is wrong because 16 VLAN attachments exceed the maximum of 8 for a 10 Gbps Dedicated Interconnect; this limit is not configurable and is enforced by Google Cloud's resource allocation model. Option B is wrong because 4 VLAN attachments is too low; while a 10 Gbps interconnect can support up to 8 attachments, 4 is not the maximum and reflects a misunderstanding of the scaling limits. Option C is wrong because 2 VLAN attachments is far below the actual limit; this misconception might arise from confusing Dedicated Interconnect with Partner Interconnect, which has different attachment limits per connection.

Practice this question →
55
MCQmedium

An engineer needs to monitor the operational status of a Dedicated Interconnect link. Which Cloud Monitoring metric should they use?

A.interconnect/attachment/operational_status
B.interconnect/network/sent_bytes_count
C.interconnect/link/operational_status
D.interconnect/network/received_bytes_count
AnswerC

This metric shows the operational state of the link.

Why this answer

The metric interconnect/link/operational_status reflects if the link is up or down, exactly what is needed to monitor the link status.

Practice this question →
56
MCQhard

A company wants to use BGP AS path prepending to influence traffic from Google Cloud to their on-premises network. They have two Dedicated Interconnect connections. Where should they configure the AS path prepending?

A.On the Cloud Router BGP session.
B.In the VLAN attachment configuration.
C.On the on-premises router by adding extra AS numbers to the AS path.
D.In the Cloud Router as a route policy with set as-path prepend.
AnswerC

AS path prepending is done on the on-premises side to affect inbound traffic from GCP.

Why this answer

AS path prepending is configured on the on-premises router when advertising routes to Google Cloud. The router adds extra AS numbers to make a path less preferred.

Practice this question →
57
MCQeasy

A company wants to migrate a legacy application to Google Cloud that requires low-latency communication with on-premises databases. The application is latency-sensitive and must use private IP addresses only. Which hybrid connectivity solution should they choose?

A.Partner Interconnect
B.Cloud VPN
C.Carrier Peering
D.Direct Peering
AnswerA

Partner Interconnect provides dedicated, low-latency private connectivity.

Why this answer

Partner Interconnect is the correct choice because it provides a dedicated, high-bandwidth connection with low latency, supports private IP addresses, and meets the requirement for latency-sensitive communication with on-premises databases. Unlike other options, it offers a Service Level Agreement (SLA) for uptime and performance, ensuring consistent low-latency connectivity.

Exam trap

Google Cloud often tests the misconception that Cloud VPN is sufficient for low-latency requirements, but the trap here is that VPNs introduce encryption overhead and rely on the public internet, which cannot guarantee the low latency and private IP addressing needed for latency-sensitive applications.

How to eliminate wrong answers

Option B (Cloud VPN) is wrong because it uses the public internet with IPsec encryption, which introduces higher latency and jitter, making it unsuitable for latency-sensitive applications. Option C (Carrier Peering) is wrong because it provides connectivity to Google Cloud through a carrier's network but does not offer a private connection with guaranteed low latency or an SLA, and it may still traverse the public internet. Option D (Direct Peering) is wrong because it is designed for exchanging traffic between Google and a customer's network at an edge location, but it does not support private IP addresses and lacks an SLA, making it inappropriate for latency-sensitive hybrid connectivity.

Practice this question →
58
Multi-Selecthard

A network engineer is configuring HA VPN between GCP and an on-premises network. They need to ensure that the VPN tunnels are established and BGP sessions are up. Which THREE steps are required? (Choose 3.)

Select 3 answers
A.Create an HA VPN gateway with two interfaces and two external IPs.
B.Configure firewall rules to allow IKE traffic.
C.Set up Cloud NAT for internet access.
D.Create two VPN tunnels, one for each interface.
E.Create a Cloud Router to manage BGP sessions.
AnswersA, D, E

Required for HA VPN.

Why this answer

To establish HA VPN, you must create the VPN gateway with two interfaces and two external IPs, configure a Cloud Router to handle BGP, and create two VPN tunnels (one for each interface) with IKEv2 configuration. Pre-shared keys or certificates are part of tunnel configuration, but the key step is creating the tunnels.

Practice this question →
59
MCQeasy

A company wants to connect an on-premises network to Google Cloud using Cloud VPN. The on-premises network has a single subnet and no dynamic routing capabilities. The company needs a simple, low-cost solution. Which VPN configuration should they choose?

A.Classic VPN with route-based configuration
B.HA VPN with dynamic routing (BGP)
C.HA VPN with static routing
D.Classic VPN with policy-based configuration
AnswerA

Classic VPN route-based supports static routing without BGP, ideal for simple setups.

Why this answer

Classic VPN with route-based configuration is the correct choice because the on-premises network lacks dynamic routing capabilities and requires a simple, low-cost solution. Route-based VPNs use static routes and do not require BGP, making them ideal for environments without dynamic routing support. Classic VPN is the legacy, lower-cost option compared to HA VPN, and route-based configuration allows traffic to be forwarded based on routing table entries rather than policy-based selectors.

Exam trap

Google Cloud often tests the misconception that HA VPN is always superior, but the trap here is that HA VPN is unnecessary and more expensive for a simple, single-subnet network without dynamic routing, leading candidates to overlook the simpler Classic VPN option.

How to eliminate wrong answers

Option B is wrong because HA VPN with dynamic routing (BGP) requires BGP support on the on-premises side, which the company does not have, and it is more complex and costly than needed. Option C is wrong because HA VPN with static routing, while technically possible, is overkill for a simple, low-cost solution; HA VPN is designed for high availability and incurs higher costs and complexity than Classic VPN. Option D is wrong because Classic VPN with policy-based configuration requires defining traffic selectors (source/destination subnets and protocols), which adds complexity and is less flexible than route-based configuration; route-based is simpler and more suitable for a single-subnet network.

Practice this question →
60
MCQmedium

A company wants to connect their on-premises network to Google Cloud with a Dedicated Interconnect. They have ordered a circuit from a telecom provider and need to complete the setup. Which of the following steps is required during the provisioning process?

A.Set up a VPN tunnel for redundancy.
B.Create a VLAN attachment in the Google Cloud Console.
C.Configure on-premises DNS forwarding to Cloud DNS.
D.Configure the Cloud Router BGP session before ordering the circuit.
AnswerB

The VLAN attachment is the logical connection between your on-premises network and Google Cloud.

Why this answer

When provisioning a Dedicated Interconnect, after the telecom provider has delivered the circuit to the meet-me room, you must create a VLAN attachment (formerly called a VLAN attachment or interconnect attachment) in the Google Cloud Console. This attachment defines the VLAN and the Cloud Router that will establish BGP peering with your on-premises router, making it the essential step to complete the Layer 2 and Layer 3 connectivity.

Exam trap

The PCNE exam often tests the misconception that you must configure the Cloud Router BGP session before the circuit is ordered, but in reality, the BGP session is configured after the VLAN attachment is created and the physical circuit is ready.

How to eliminate wrong answers

Option A is wrong because a VPN tunnel is not required for Dedicated Interconnect; while you can optionally set up a VPN as a backup for redundancy, it is not a required step during the provisioning process of the Dedicated Interconnect itself. Option C is wrong because configuring on-premises DNS forwarding to Cloud DNS is unrelated to the physical or logical setup of Dedicated Interconnect; DNS forwarding is a separate network service configuration. Option D is wrong because the Cloud Router BGP session cannot be configured before ordering the circuit; you must first have the VLAN attachment created and the circuit provisioned before you can configure BGP sessions on the Cloud Router.

Practice this question →
61
Multi-Selecthard

An organization is setting up a Dedicated Interconnect and wants to monitor the health and performance of the connection using Cloud Monitoring. Which THREE metrics are available for Dedicated Interconnect?

Select 3 answers
A.interconnect/network/received_bytes_count
B.interconnect/link/packet_loss
C.interconnect/link/operational_status
D.interconnect/network/traffic_drops
E.interconnect/vpn/tunnel_status
AnswersA, B, C

This metric tracks bytes received over the interconnect.

Why this answer

Cloud Monitoring provides several metrics for Dedicated Interconnect, including traffic volume (received_bytes_count), link operational status, and packet loss. VLAN attachment metrics are also available, but the question asks for interconnect metrics.

Practice this question →
62
MCQeasy

An organization uses Partner Interconnect to connect their on-premises network to Google Cloud. They are experiencing intermittent connectivity issues and suspect the partner service provider is causing the problem. Which Google Cloud tool or feature can help verify the connection status and performance from the Google Cloud side?

A.Cloud Router logs
B.Network Service Tiers
C.VPC flow logs
D.Cloud Interconnect monitoring
AnswerD

Cloud Interconnect monitoring provides metrics and alerts for interconnect attachments, including partner interconnects.

Why this answer

Cloud Interconnect monitoring provides detailed metrics and status information for Partner Interconnect connections, including VLAN attachment health, throughput, and packet loss. This tool allows you to verify connectivity and performance from the Google Cloud side, helping isolate issues that may originate from the partner service provider.

Exam trap

The trap here is that candidates confuse Cloud Router logs (which show BGP routing events) with the ability to monitor the underlying interconnect link status, but Cloud Interconnect monitoring is the correct tool for verifying physical/virtual circuit health and performance from Google's perspective.

How to eliminate wrong answers

Option A is wrong because Cloud Router logs capture BGP routing events and route advertisements, not the underlying physical or virtual circuit health or performance metrics of the interconnect. Option B is wrong because Network Service Tiers control the quality of service for internet egress traffic (Premium vs. Standard), not the monitoring or troubleshooting of dedicated interconnect links.

Option C is wrong because VPC flow logs record metadata about network flows within a VPC (e.g., source/destination IPs, ports, protocols), but they do not provide status or performance data for the interconnect connection itself.

Practice this question →
63
MCQeasy

A company needs to resolve on-premises DNS names from Google Cloud VMs. They want to forward DNS queries for a specific domain (example.corp) to an on-premises DNS server. Which Cloud DNS feature should they use?

A.Private DNS zones
B.DNS peering
C.Inbound DNS policy
D.Outbound DNS forwarding (conditional forwarding)
AnswerD

This is the feature for forwarding specific domains to on-premises DNS.

Why this answer

Outbound DNS forwarding with conditional forwarding allows Cloud DNS to forward queries for a specific domain (example.corp) to an on-premises DNS server. This is the correct feature because it selectively routes DNS traffic based on the domain name, enabling resolution of private on-premises names from Google Cloud VMs without exposing the entire VPC network.

Exam trap

Google Cloud often tests the distinction between inbound and outbound DNS policies. Candidates may confuse the direction of DNS traffic and select Inbound DNS policy (Option C) instead of Outbound DNS forwarding.

How to eliminate wrong answers

Option A is wrong because Private DNS zones are used to manage DNS records within a VPC network, not to forward queries to external servers. Option B is wrong because DNS peering allows DNS resolution between two VPC networks, not forwarding to on-premises servers. Option C is wrong because Inbound DNS policy handles DNS queries coming into Google Cloud from on-premises, not outbound forwarding from Google Cloud to on-premises.

Practice this question →
64
MCQhard

A multinational corporation is connecting five on-premises data centers to Google Cloud using Cloud Interconnect. Each data center has a dedicated 10 Gbps connection. They want to ensure that if one Interconnect fails, traffic is automatically redistributed across the remaining connections without manual intervention. Which solution meets this requirement?

A.Configure multiple VLAN attachments on a single Cloud Router and rely on link aggregation
B.Deploy Cloud VPN tunnels as backup and configure static routes with lower priority
C.Configure VPC Network Peering between all data centers and Google Cloud
D.Use a Cloud Router with BGP and establish multiple BGP sessions over each Interconnect
AnswerD

BGP with ECMP allows automatic failover across multiple Interconnects.

Why this answer

Cloud Router with BGP enables dynamic routing, allowing multiple BGP sessions over each Cloud Interconnect. When one interconnect fails, BGP withdraws the affected routes, and traffic is automatically redistributed across the remaining BGP sessions without manual intervention. This meets the requirement for automatic failover and load balancing across the five 10 Gbps connections.

Exam trap

Google Cloud often tests the misconception that static routes or VPN tunnels can provide seamless automatic failover for high-bandwidth interconnects, but the correct approach requires dynamic BGP routing to react to link failures without manual intervention.

How to eliminate wrong answers

Option A is wrong because VLAN attachments on a single Cloud Router do not provide automatic failover; link aggregation (LAG) bundles multiple connections into a single logical link but does not redistribute traffic if one physical link fails—it only provides increased bandwidth and redundancy within the bundle, not across separate interconnects. Option B is wrong because Cloud VPN tunnels as backup with static routes require manual intervention or additional automation to fail over; static routes with lower priority do not dynamically react to interconnect failures, and VPN tunnels typically have lower bandwidth (e.g., 3 Gbps per tunnel) compared to 10 Gbps interconnects, making them unsuitable for seamless redistribution. Option C is wrong because VPC Network Peering is used for connecting VPC networks within Google Cloud, not for connecting on-premises data centers to Google Cloud; it does not support Cloud Interconnect or BGP-based dynamic routing for hybrid connectivity.

Practice this question →
65
Multi-Selectmedium

Which three of the following are best practices for designing a highly available Dedicated Interconnect connection to Google Cloud? (Choose three.)

Select 3 answers
A.Use a single Cloud Router for both interconnect attachments.
B.Ensure that the on-premises routers are in different failure zones.
C.Configure both connections to use the same BGP session.
D.Use VLAN attachments in different regions to provide geographic redundancy.
E.Deploy two physical connections to different Google edge availability domains.
AnswersB, D, E

Diverse on-premises routers prevent single point of failure.

Why this answer

Deploying on-premises routers in different failure zones ensures that a single zone failure does not disrupt both BGP sessions. This aligns with Google Cloud's recommendation to use diverse failure domains for on-premises equipment to maintain high availability for Dedicated Interconnect.

Exam trap

The trap here is that candidates often assume a single Cloud Router or a single BGP session simplifies management, but this creates a single point of failure that violates high-availability design principles.

Practice this question →
66
Multi-Selecteasy

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

Select 2 answers
A.Verify that the on-premises network has IAM permissions to access instances
B.Confirm that the subnet routes for the instance IP ranges are present in the VPC
C.Verify that VPC firewall rules allow traffic from the on-premises subnets
D.Ensure that the VLAN attachment IP is in the same subnet as the instances
E.Check that BGP sessions are established between Cloud Router and on-premises router
AnswersB, C

Routes must exist for return traffic.

Why this answer

For on-premises traffic to reach Compute Engine instances over Dedicated Interconnect, the VPC must have a subnet route (either automatically created or custom static/dynamic route) that matches the instance IP ranges. Without this route, packets from the on-premises network will be dropped by the VPC router, even if the VLAN attachment is reachable.

Exam trap

Google Cloud often tests the misconception that pinging the VLAN attachment IP confirms end-to-end connectivity to instances, but in reality it only confirms BGP session health and Layer 3 reachability to the Cloud Router interface, not the VPC routing or firewall rules required for instance access.

Practice this question →
67
MCQmedium

A company has set up a Cloud VPN with dynamic routing (BGP) between their on-premises network (AS 65001) and Google Cloud (AS 64514). They are using Cloud Router with a regional dynamic routing mode. The on-premises router is advertising a subnet 10.1.0.0/16. The Google Cloud VPC has subnet 10.2.0.0/16 in the same region as the Cloud Router. Both subnets are unique. The connection has been working for months. However, after a recent maintenance window, the on-premises router started experiencing BGP flapping with the Cloud Router. The Cloud Router logs show 'BGP notification sent: Hold timer expired'. The on-premises router logs show similar errors. The network team has verified that the VPN tunnel is established and stable. What is the most likely cause of the BGP flapping?

A.The VPN tunnel's MTU is set to 1500 bytes, but BGP packets are larger and are being fragmented.
B.The Cloud Router's BGP keepalive interval is set to 30 seconds, while the on-premises router is using 10 seconds.
C.The on-premises router's BGP hold timer is set to 30 seconds, but the Cloud Router's hold timer is set to 180 seconds.
D.The on-premises router is advertising too many routes, causing the Cloud Router to run out of memory.
AnswerC

If the remote side sends keepalives less frequently than the local hold timer, the session drops.

Why this answer

The BGP hold timer defines the maximum time a router waits to receive a keepalive or update message from a peer before declaring the session dead. When the on-premises router uses a hold timer of 30 seconds and the Cloud Router uses 180 seconds, the on-premises router expects keepalives every 10 seconds (one-third of hold time). If the Cloud Router sends keepalives at its own negotiated interval (e.g., 60 seconds based on its hold timer), the on-premises router will not receive them within its 30-second window, causing it to send a 'Hold timer expired' notification and flap the BGP session.

The VPN tunnel remains stable because the issue is at the BGP session layer, not the underlying tunnel.

Exam trap

Google Cloud often tests the misconception that BGP flapping is always caused by VPN tunnel instability, but here the tunnel is stable and the issue is specifically a BGP hold timer mismatch, which is a common misconfiguration when connecting to cloud providers with fixed BGP timers.

How to eliminate wrong answers

Option A is wrong because BGP packets are typically small (keepalives are 19 bytes, updates rarely exceed 1500 bytes) and fragmentation is handled by IP, not a common cause of hold timer expiry. Option B is wrong because BGP keepalive intervals are derived from the negotiated hold timer (one-third of hold time), not independently configured; mismatched keepalive intervals would be overridden by the hold timer negotiation. Option D is wrong because advertising too many routes would cause memory or CPU issues, not a 'Hold timer expired' error; the Cloud Router would log route limit or memory errors instead.

Practice this question →
68
Multi-Selecthard

You are setting up Partner Interconnect with a service provider that offers both Layer 2 and Layer 3 options. Your on-premises network uses BGP to exchange routes. Which THREE statements are true about the connectivity types? (Choose three.)

Select 3 answers
A.Layer 3 connectivity requires a VLAN attachment of type PARTNER_PROVIDER
B.With Layer 2 connectivity, you must configure BGP sessions between your on-premises router and Cloud Router
C.Both connectivity types support dynamic routing with BGP
D.With Layer 3 connectivity, the service provider manages BGP peering with your Cloud Router
E.Layer 2 connectivity requires a VLAN attachment of type PARTNER_PROVIDER
AnswersB, C, D

With Layer 2 connectivity, you manage BGP sessions between on-premises router and Cloud Router. This statement is correct.

Why this answer

In Google Cloud Partner Interconnect, Layer 2 connectivity provides a transparent VLAN extension, requiring you to configure and manage your own BGP sessions between your on-premises router and a Cloud Router (option B correct). Layer 3 connectivity offloads BGP management to the service provider, who peers with your Cloud Router (option D correct). Both connectivity types support dynamic routing with BGP (option C correct).

Option A is incorrect because Layer 3 uses a VLAN attachment of type PARTNER, not PARTNER_PROVIDER. Option E is incorrect because Layer 2 uses a VLAN attachment of type PARTNER, not PARTNER_PROVIDER.

Exam trap

Candidates often confuse the attachment types (PARTNER vs PARTNER_PROVIDER) and who manages BGP sessions, incorrectly assuming that Layer 3 connectivity requires direct BGP configuration on the Cloud Router.

Practice this question →
69
MCQmedium

An engineer has set up a Dedicated Interconnect with a VLAN attachment and a Cloud Router BGP session. They can ping the on-premises gateway IP but cannot reach an on-premises subnet 10.0.0.0/24 from a GCE instance. The on-premises router is advertising the subnet via BGP. What is the most likely cause?

A.The VLAN attachment is in the wrong region
B.The GCE instance does not have a route to the on-premises subnet
C.The on-premises firewall is blocking ICMP
D.The on-premises router is not using the correct BGP AS number
AnswerB

If the Cloud Router is not advertising the on-premises subnet correctly, or custom route propagation is not enabled, the VPC may lack a route to 10.0.0.0/24.

Why this answer

The GCE instance can ping the on-premises gateway IP because the Cloud Router has a BGP session and the gateway IP is directly reachable via the VLAN attachment. However, to reach the on-premises subnet 10.0.0.0/24, the GCE VPC needs a route for that subnet pointing to the Cloud Router as the next hop. Without an automatically propagated or manually configured route in the VPC, traffic from the GCE instance to 10.0.0.0/24 will be dropped, even though the on-premises router is advertising the subnet via BGP.

Exam trap

The PCNE exam often tests the misconception that BGP route advertisement alone ensures reachability, but in Google Cloud, the VPC route table must explicitly include the learned prefix via dynamic route propagation or a static route.

How to eliminate wrong answers

Option A is wrong because the VLAN attachment region must match the Cloud Router region for the BGP session to establish; if it were in the wrong region, the BGP session would not come up and the engineer could not ping the on-premises gateway IP. Option C is wrong because the engineer can already ping the on-premises gateway IP, which demonstrates that ICMP is not blocked by the on-premises firewall; the issue is specifically with reaching a different subnet. Option D is wrong because if the on-premises router were using the wrong BGP AS number, the BGP session would not establish, and the engineer could not ping the on-premises gateway IP or receive any route advertisements.

Practice this question →
70
MCQmedium

A company has deployed Dedicated Interconnect with a 10 Gbps connection. They are experiencing packet loss when transferring large files. The on-premises MTU is set to 1500. What is the maximum MTU that can be set on the Cloud Router interface to avoid fragmentation?

A.1460 bytes
B.1500 bytes
C.1400 bytes
D.8896 bytes
AnswerB

Must match the on-premises MTU to avoid fragmentation.

Why this answer

Dedicated Interconnect uses VLAN attachments that encapsulate packets with an additional 4-byte 802.1Q VLAN tag and a 4-byte outer Ethernet header. With an on-premises MTU of 1500 bytes, the maximum payload that can traverse the interconnect without fragmentation is 1500 bytes, because the interconnect path supports jumbo frames up to 1440 bytes for the payload after overhead, but the Cloud Router interface MTU must match the on-premises MTU to avoid fragmentation. Setting the Cloud Router MTU to 1500 bytes ensures that packets are not fragmented at the router, as the interconnect handles the encapsulation overhead transparently.

Exam trap

Google Cloud often tests the misconception that the Cloud Router MTU must be reduced to account for VLAN encapsulation overhead, but in Google Cloud Dedicated Interconnect, the Cloud Router MTU should match the on-premises MTU because the interconnect handles the additional headers transparently.

How to eliminate wrong answers

Option A is wrong because 1460 bytes assumes an additional 40-byte overhead (e.g., IPsec or GRE tunnel), but Dedicated Interconnect does not add such overhead; the VLAN tag is only 4 bytes and is handled by the interconnect, not the Cloud Router MTU. Option C is wrong because 1400 bytes is an arbitrary low value that would cause unnecessary fragmentation and performance degradation, as the actual path supports 1500-byte packets without issue. Option D is wrong because 8896 bytes is the maximum MTU for Google Cloud's jumbo frame support, but the on-premises MTU is 1500, so setting the Cloud Router MTU higher would cause fragmentation when packets exceed the on-premises limit.

Practice this question →
71
Multi-Selecteasy

A company is deploying Cloud DNS to enable on-premises resources to resolve Google Cloud private zone names. Which TWO resources are required for this setup?

Select 2 answers
A.VPC peering
B.Inbound DNS policy
C.Cloud Router
D.On-premises DNS server configuration to forward to the inbound IP
E.Outbound DNS forwarding zone
AnswersB, D

Inbound DNS policy provides a forwarding IP for on-premises to query GCP DNS.

Why this answer

To allow on-premises DNS queries to reach Google Cloud private zones, you need an inbound DNS policy that creates a forwarding IP address in a VPC, and you need to configure on-premises DNS servers to forward those queries to that IP. A forwarding zone is used for the opposite direction (GCP to on-premises).

Practice this question →
72
MCQmedium

A company has deployed an HA VPN gateway in Google Cloud to connect to their on-premises network. They have configured two tunnels with IKEv2 and BGP. One tunnel is established, but the second tunnel is not coming up. What could be a likely cause?

A.IKE version is set to IKEv1 on one side
B.The pre-shared keys are mismatched between the two tunnels
C.The second tunnel's peer IP is unreachable
D.BGP timers are inconsistent
AnswerB

A common pitfall is using different PSKs for each tunnel; they must match on both sides.

Why this answer

Common issues include mismatched pre-shared keys or IKE versions. Since the first tunnel works, the configuration is mostly correct, but the second tunnel may have a different pre-shared key or PSK mismatch. Incorrect IKE version is less likely because both tunnels use the same gateway.

BGP timers are usually consistent. Cloud VPN logs would help identify the root cause.

Practice this question →
73
MCQeasy

An engineer needs to set up DNS resolution for on-premises resources from Google Cloud. They want to resolve a custom domain (e.g., corp.example.com) using on-premises DNS servers. Which Cloud DNS feature should they use?

A.DNS forwarding zone
B.Cloud DNS peering
C.Outbound DNS forwarding
D.Inbound DNS policy
AnswerA

A forwarding zone in Cloud DNS forwards queries for a specific domain to specified DNS servers.

Why this answer

DNS forwarding zones in Cloud DNS allow you to forward queries for a specific domain to a set of on-premises DNS server IPs. This is achieved by creating a forwarding zone with the target name servers pointing to the on-premises DNS servers.

Practice this question →
74
MCQeasy

A company wants to use HA VPN with route-based VPN. Which VPN configuration option must be enabled?

A.IKEv1 with pre-shared keys.
B.Route-based VPN by selecting Dynamic Routing (BGP) or using static routes.
C.Using certificates instead of pre-shared keys.
D.Policy-based VPN with multiple policies for each subnet.
AnswerB

Route-based VPN relies on routing for traffic direction.

Why this answer

Route-based VPN uses routing (BGP or static routes) to determine which traffic goes through the tunnel, as opposed to policy-based which uses security policies.

Practice this question →
75
MCQeasy

An organization wants to migrate legacy on-premises applications to Google Cloud but must maintain low-latency connectivity for real-time data synchronization. The on-premises data center is in a colocation facility that is not directly served by Google Cloud. Which hybrid connectivity option is most cost-effective while meeting the latency requirement?

A.Direct Peering
B.Cloud VPN with dynamic routing
C.Partner Interconnect
D.Dedicated Interconnect
AnswerC

Uses a service provider to connect to Google Cloud, cost-effective and low latency.

Why this answer

Partner Interconnect is the most cost-effective option because it provides a dedicated, low-latency connection through a supported service provider that can extend connectivity from the colocation facility to a Google Cloud region. Unlike Dedicated Interconnect, it does not require physical cross-connects in a Google Cloud colocation facility, making it ideal when the on-premises site is not directly served by Google Cloud. It meets the real-time synchronization latency requirement by offering a reliable, high-bandwidth connection with SLA-backed uptime.

Exam trap

Google Cloud often tests the misconception that Direct Peering or Cloud VPN can meet low-latency requirements, but the trap here is that only Partner Interconnect or Dedicated Interconnect provide SLA-backed, low-latency connectivity, and Partner Interconnect is the correct choice when the on-premises site is not in a Google Cloud colocation facility.

How to eliminate wrong answers

Option A is wrong because Direct Peering is not a Google Cloud connectivity product; it is a BGP-based peering arrangement at an IXP that does not provide SLA-backed connectivity or guaranteed bandwidth, and it is not designed for hybrid cloud connectivity to Google Cloud. Option B is wrong because Cloud VPN with dynamic routing uses the public internet, which introduces variable latency and jitter that cannot guarantee the low-latency requirement for real-time data synchronization. Option D is wrong because Dedicated Interconnect requires a physical cross-connect in a Google Cloud colocation facility, and the on-premises data center is in a colocation facility not directly served by Google Cloud, making it impractical and more expensive to implement.

Practice this question →
Page 1 of 3 · 212 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Implementing Hybrid Interconnectivity questions.

Start 20-question session