Courseiva

CCNA Implementing Hybrid Interconnectivity Questions

75 of 212 questions · Page 2/3 · Implementing Hybrid Interconnectivity · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQeasy

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

A.Classic VPN with a static IP on the peer
B.A custom SSL VPN appliance on Compute Engine
C.HA VPN with a single VPN gateway and a dynamic peer IP
D.HA VPN with two VPN gateways and static peer IPs
AnswerC

HA VPN supports dynamic peer IP addresses, making it suitable for branches with dynamic IPs.

Why this answer

HA VPN supports dynamic peer IP addresses through its use of IKEv2 and route-based VPN tunnels. When the branch office has a dynamic public IP, HA VPN can establish tunnels using the peer's current IP address, which is discovered during IKE negotiation. Classic VPN (option A) requires a static peer IP, and option D requires two static peer IPs, making them unsuitable for a dynamic IP scenario.

Exam trap

The trap here is that candidates often assume HA VPN always requires static peer IPs, but the Google Cloud PCNE exam tests the nuance that HA VPN with a single gateway (and dynamic peer IP support) is the correct choice when the remote peer has a dynamic public IP, not the dual-gateway HA configuration.

How to eliminate wrong answers

Option A is wrong because Classic VPN with a static IP on the peer requires the branch office to have a static public IP address, which contradicts the given dynamic IP condition. Option B is wrong because a custom SSL VPN appliance on Compute Engine is not a native Cloud VPN service; it introduces additional complexity, licensing, and management overhead, and is not the recommended or simplest solution for site-to-site IPsec VPN connectivity. Option D is wrong because HA VPN with two VPN gateways and static peer IPs requires both peer IPs to be static, which is not possible when the branch office has a single dynamic public IP.

Practice this question →
77
MCQmedium

A customer has established a Dedicated Interconnect, but traffic from on-premises to Google Cloud is still using the internet path instead of the interconnect. What is the most likely cause?

A.The on-premises firewall blocks BGP traffic.
B.The Google Cloud Router has not learned any routes.
C.The VLAN attachment is in a different region.
D.The BGP routes from on-premises have a lower priority than the default route via internet.
AnswerD

Route priority (e.g., weight, MED) determines which path is used; lower priority routes are less preferred.

Why this answer

Google Cloud uses route priority to determine which route is used when multiple routes match a destination. The default route (0.0.0.0/0) is a system route with priority 0 (highest priority). BGP routes learned via Dedicated Interconnect have a priority of 200 (lower priority).

When both exist, the route with the lower priority number (higher priority) wins, so the default route via the internet takes precedence over the BGP routes from the interconnect. This causes traffic to use the internet path instead of the interconnect.

Exam trap

Google Cloud often tests the misconception that BGP routes are always preferred over system routes, but the trap here is that the default system route has higher priority (lower numerical value) than BGP routes, causing the internet path to be used.

How to eliminate wrong answers

Option A is wrong because if the on-premises firewall blocks BGP traffic, the BGP session would not establish at all, resulting in no routes learned via the interconnect, not a scenario where traffic still uses the internet path while BGP is up. Option B is wrong because if the Google Cloud Router has not learned any routes, there would be no path via the interconnect, and traffic would default to the internet; however, the question states the interconnect is established, implying BGP sessions are up and routes are exchanged, so this is not the most likely cause. Option C is wrong because the VLAN attachment must be in the same region as the Cloud Router for the interconnect to function; if it were in a different region, the interconnect would not be operational, and the customer would not have a working Dedicated Interconnect.

Practice this question →
78
Multi-Selecthard

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Select 2 answers
A.Change the BGP ASN on the Cloud Router to a different number
B.Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address
C.Increase the BGP hold timer on the Cloud Router
D.Change the BGP keepalive interval to 10 seconds
E.Verify the Cloud VPN tunnel is established and passing traffic
AnswersB, E

Without a return route, BGP packets cannot reach the Cloud Router.

Why this answer

When the BGP session state is stuck in 'CONNECT', it indicates that the router is actively trying to initiate a TCP connection to the peer but is not receiving a response. For BGP to establish a TCP session (port 179), the on-premises router must have a valid IP route to the Cloud Router's BGP peer IP address. Without this route, TCP SYN packets are dropped, preventing the session from transitioning to 'ESTABLISHED'.

Exam trap

Google Cloud often tests the misconception that BGP session issues in the 'CONNECT' state are caused by BGP timer or ASN misconfigurations, when the real root cause is almost always a lack of IP reachability (missing route or tunnel failure) preventing the TCP connection from forming.

Practice this question →
79
Matchingmedium

Match each Google Cloud Armor feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Pre-configured rules to block common web attacks

Limits requests per client to prevent abuse

Allows or denies traffic from specific IPs

ML-based detection of DDoS and application attacks

Rules attached to backend services or load balancers

Why these pairings

Cloud Armor features include Security Policies (rule-based traffic filtering), WAF Rules (web vulnerability protection), and DDoS Protection (edge mitigation). Common confusions mix WAF with IP lists or rate limiting.

Practice this question →
80
Multi-Selectmedium

A company is designing a hybrid network with Partner Interconnect. They need to ensure high availability and meet a 99.99% SLA. Which TWO actions should they take?

Select 2 answers
A.Provision two Partner Interconnects from different providers or locations
B.Create two VLAN attachments, each on a different Interconnect
C.Enable VPN as a backup to the Interconnect
D.Create a single VLAN attachment with multiple BGP sessions
E.Provision a single Partner Interconnect with two VLAN attachments
AnswersA, B

Redundant Interconnects are required for high availability.

Why this answer

To meet a 99.99% SLA, the design must eliminate single points of failure at both the physical interconnect and the logical attachment level. Provisioning two Partner Interconnects from different providers or locations ensures physical diversity, while creating two VLAN attachments (each on a different Interconnect) provides logical redundancy, allowing traffic to fail over if one attachment or interconnect fails.

Exam trap

Google Cloud often tests the misconception that multiple BGP sessions on a single attachment or a single interconnect provide sufficient redundancy, but the trap here is that the 99.99% SLA requires both physical and logical diversity, so candidates must recognize that a single interconnect (even with two VLAN attachments) is a single point of failure.

Practice this question →
81
MCQmedium

A company has a VPC with subnets in us-east1 and us-west1. They have established a Cloud VPN tunnel to their on-premises network through a Cloud Router in us-east1. They want to ensure that traffic from on-premises to resources in us-west1 uses the VPN tunnel and not the public internet. What must be configured?

A.Configure a custom dynamic route on the Cloud Router for us-west1 subnets
B.Create a separate VPN tunnel from on-premises to a Cloud Router in us-west1
C.Add a route on the on-premises router for us-west1 subnets with next hop pointing to the VPN tunnel
D.Configure VPC firewall rules to allow traffic from on-premises to us-west1
AnswerC

The on-premises router must have a route for the remote subnets pointing to the VPN tunnel to forward traffic through it.

Why this answer

The on-premises router must have a route for the us-west1 subnets with the VPN tunnel as the next hop. Without this, the on-premises router will use its default route (typically the public internet) to reach us-west1, bypassing the VPN tunnel. The Cloud Router in us-east1 advertises the us-west1 subnets via BGP over the VPN tunnel, but the on-premises router must be explicitly configured to forward traffic for those subnets into the tunnel.

Exam trap

The trap here is that candidates assume the Cloud Router automatically directs traffic to the correct region, but the on-premises router must have an explicit route for the remote subnets pointing to the VPN tunnel, as the Cloud Router only advertises routes and does not control the on-premises forwarding table.

How to eliminate wrong answers

Option A is wrong because the Cloud Router already advertises the us-west1 subnets via BGP if they are in the same VPC; configuring a custom dynamic route on the Cloud Router is unnecessary and does not control the on-premises router's forwarding decision. Option B is wrong because a separate VPN tunnel to us-west1 is not required; the existing VPN tunnel in us-east1 can carry traffic to us-west1 as long as the on-premises router has a route pointing to it, and Cloud Router can advertise the us-west1 prefixes over the existing BGP session. Option D is wrong because VPC firewall rules control traffic within Google Cloud, not routing decisions on the on-premises side; they do not force traffic to use the VPN tunnel.

Practice this question →
82
Multi-Selecteasy

An organization is experiencing high latency on their Partner Interconnect connection. Which TWO tools or features can they use to diagnose the issue from within Google Cloud? (Choose two.)

Select 2 answers
A.Network Intelligence Center performance dashboard
B.Cloud Router logs
C.Cloud Load Balancing logs
D.VPC Flow Logs
E.Cloud Interconnect monitoring metrics
AnswersD, E

Flow logs can show RTT and help pinpoint which traffic is experiencing latency.

Why this answer

VPC Flow Logs capture metadata about network traffic flowing to and from VPC instances, including latency-related metrics such as packet loss and retransmissions. By analyzing these logs, you can identify if high latency is caused by dropped packets or congestion on the Partner Interconnect link. This makes VPC Flow Logs a direct diagnostic tool for latency issues from within Google Cloud.

Exam trap

Google Cloud often tests the misconception that Cloud Router logs or Load Balancing logs can diagnose network latency, when in fact they are designed for BGP routing events and application-layer metrics, respectively, not for interconnect-level packet loss or latency.

Practice this question →
83
MCQhard

Refer to the exhibit. A network engineer configured a Cloud Router to advertise the on-premises subnet 10.0.0.0/8 to the VPC. However, traffic from VPC instances to 10.0.0.0/8 is being dropped. What is the most likely issue?

A.The advertised route has a priority that is too low.
B.The Cloud Router's ASN is private, causing routes to be rejected.
C.The subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range.
D.The on-premises router is not configured to accept the advertised route.
AnswerC

Overlap causes VPC to prefer local routes, dropping traffic destined for on-premises.

Why this answer

Cloud Router uses custom route advertisements, and if the on-premises subnet 10.0.0.0/8 overlaps with the VPC's auto-allocated IP range (e.g., the default or custom subnet ranges within the VPC), Google Cloud will not install or will drop traffic for that route due to a conflict. Overlapping routes cause the VPC to prefer its own local routes, resulting in dropped traffic to the on-premises subnet.

Exam trap

Google Cloud often tests the misconception that route priority or BGP ASN issues cause traffic drops, but the trap here is that overlapping IP ranges between on-premises and VPC subnets silently cause traffic to be dropped due to VPC local route precedence, not because of BGP configuration errors.

How to eliminate wrong answers

Option A is wrong because route priority (preference) in Cloud Router is used for route selection among multiple paths, but a low priority does not cause traffic to be dropped; it would simply make the route less preferred, not block it entirely. Option B is wrong because Cloud Router supports private ASNs (e.g., 64512-65534) by default, and BGP does not reject routes based solely on ASN being private; the on-premises router must be configured to accept private ASNs if needed, but this is not the cause of traffic being dropped within the VPC. Option D is wrong because the on-premises router not accepting the advertised route would prevent the route from being learned on-premises, but the question states traffic from VPC instances to 10.0.0.0/8 is being dropped, which is a VPC-side issue, not an on-premises acceptance problem.

Practice this question →
84
MCQeasy

A company wants to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have ordered a 10 Gbps connection and plan to use a single VLAN attachment. How many Cloud Router interfaces are required for a single VLAN attachment with active/active BGP?

A.4 interfaces (two for each BGP session)
B.2 interfaces (one for each VLAN)
C.1 interface
D.2 interfaces (one for each BGP session)
AnswerC

A single VLAN attachment corresponds to one Cloud Router interface; you configure two BGP sessions on that same interface.

Why this answer

For a single VLAN attachment using Dedicated Interconnect with active/active BGP, only one Cloud Router interface is required. The Cloud Router interface represents the VLAN attachment itself, and BGP sessions are configured as sub-interfaces under that single interface. Active/active BGP does not require multiple interfaces; it uses two BGP sessions (one for each router in the pair) but both sessions share the same VLAN attachment and Cloud Router interface.

Exam trap

Google Cloud often tests the misconception that each BGP session requires its own interface, leading candidates to choose option D, but the correct behavior is that both sessions share the same single Cloud Router interface for a given VLAN attachment.

How to eliminate wrong answers

Option A is wrong because it incorrectly assumes that each BGP session requires two interfaces (one per session), but in reality, both BGP sessions are established over the same single VLAN attachment and Cloud Router interface. Option B is wrong because it suggests one interface per VLAN, but a single VLAN attachment uses exactly one VLAN, so only one interface is needed, not two. Option D is wrong because it claims one interface per BGP session, but both BGP sessions (active/active) share the same single Cloud Router interface; they are not separate interfaces.

Practice this question →
85
MCQmedium

An organization has two Dedicated Interconnect connections in an active-passive configuration. They want to make the passive connection active for maintenance. What should they do to fail over traffic?

A.Configure as-path prepending on the active Cloud Router BGP session to make it less preferred
B.Shut down the Cloud Router on the active connection
C.Set the MED metric to 0 on the active connection
D.Delete the VLAN attachment on the active connection
AnswerA

As-path prepending adds extra AS numbers to the path, making it less preferred in BGP path selection, causing failover to the passive connection.

Why this answer

To fail over traffic, the engineer can use as-path prepending on the active connection to make it less preferred, or adjust MED, or use local preference on the on-premises side. The question implies a GCP-side action: using as-path prepending via Cloud Router BGP configuration.

Practice this question →
86
MCQeasy

A network engineer is setting up a HA VPN between GCP and an on-premises network. They want to use route-based VPN with dynamic routing. Which two resources must be created together to form a functional HA VPN tunnel?

A.Two VPN tunnels, each with a BGP session on the same Cloud Router
B.One VPN tunnel with two BGP sessions
C.Two VPN tunnels without BGP sessions
D.Two VPN gateways, each with one tunnel and one BGP session
AnswerA

Each HA VPN interface requires its own tunnel and BGP session, sharing the same Cloud Router.

Why this answer

An HA VPN gateway has two interfaces, each with its own external IP. For each interface, you create a VPN tunnel and attach it to a Cloud Router with a BGP session. The tunnel and BGP session are paired for each interface.

Practice this question →
87
MCQmedium

A customer is configuring a route-based IPsec VPN tunnel to Google Cloud. On their on-premises router, they must specify traffic selectors (proxy IDs). What should they set the local and remote traffic selectors to?

A.Configure IKE version to match.
B.Set local to on-prem subnet and remote to VPC subnet.
C.Use policy-based VPN instead.
D.Set both local and remote traffic selectors to 0.0.0.0/0.
AnswerD

Route-based tunnels use wildcard selectors; routing decisions are based on routes, not selectors.

Why this answer

For route-based VPN, traffic selectors (proxy IDs) should be set to 0.0.0.0/0 (any) because route-based tunnels use routing tables to determine which traffic is sent through the tunnel, rather than policy-based selectors. Option A is incorrect because IKE version does not affect traffic selectors. Option B is incorrect because specifying local and remote subnets is used for policy-based VPN, not route-based.

Option C is incorrect because the question specifies route-based VPN; using policy-based VPN is unnecessary and not the correct action.

Practice this question →
88
MCQhard

A global company has multiple on-premises data centers connected to Google Cloud via separate Dedicated Interconnects. Each on-premises site advertises the same IP prefix for a critical application. They want to ensure that traffic from Google Cloud to that prefix is load-balanced across the two interconnects and also provide automatic failover. Which configuration on Cloud Router meets this requirement?

A.Configure Cloud Router with the same MED value for both paths
B.Use BGP multipath on Cloud Router with 'maximum-paths' set to 2
C.Ensure on-premises routers advertise the prefix with the same AS_PATH length and MED
D.Enable 'set-community' on the on-premises routers to mark routes equally
AnswerC

ECMP requires equal BGP path attributes including AS_PATH length and MED.

Why this answer

To load-balance and provide failover, you need equal-cost multi-path (ECMP) routing. Cloud Router supports ECMP only when the routes have the same MED and AS_PATH length. Setting both on-premises routers to advertise with the same attributes allows ECMP.

Practice this question →
89
MCQhard

A company has two HA VPN tunnels between GCP and on-premises. They want to use both tunnels simultaneously for load balancing traffic. Which BGP feature should they configure on the Cloud Router to achieve equal-cost multipath (ECMP)?

A.Use AS path prepending on one tunnel.
B.Set different MED values on each tunnel to prefer one.
C.Enable policy-based VPN instead of route-based.
D.Advertise identical routes with equal BGP metrics (AS path length, MED, etc.) from both tunnels.
AnswerD

ECMP requires equal metric values.

Why this answer

ECMP is achieved by having multiple BGP paths with equal MED and AS path length. The Cloud Router automatically load balances if routes have equal metrics.

Practice this question →
90
MCQhard

Refer to the exhibit. A Cloud VPN tunnel is configured between an on-premises router and Google Cloud. The BGP session is not established. The on-premises router shows 'Connection refused'. What is the most likely cause?

A.The Cloud VPN tunnel is not established.
B.The on-premises router's BGP configuration has the wrong ASN.
C.The BGP MD5 password is mismatched between the two peers.
D.The Cloud Router is not configured to accept BGP connections from this on-premises peer.
AnswerD

'Connection refused' indicates the Cloud Router TCP port 179 is not accepting the connection, likely because the BGP peer is not defined on the Cloud Router or the interface is down.

Why this answer

The 'Connection refused' error on the on-premises router indicates that the Cloud Router is actively rejecting the TCP connection attempt for the BGP session. This typically occurs when the Cloud Router does not have a BGP peer configured with the on-premises router's IP address, or the peer is in an 'inactive' state. Since the Cloud VPN tunnel itself can be established (option A is not necessarily true), the most likely cause is that the Cloud Router is not configured to accept BGP connections from this specific on-premises peer.

Exam trap

Google Cloud often tests the distinction between TCP-level errors (like 'Connection refused') and BGP-level errors (like ASN mismatch or MD5 failure), leading candidates to incorrectly choose B or C when they see a BGP-related symptom without analyzing the specific error message.

How to eliminate wrong answers

Option A is wrong because a 'Connection refused' error occurs at the TCP layer, which requires the underlying IP connectivity to be working; if the Cloud VPN tunnel were not established, the on-premises router would likely see 'No route to host' or a timeout, not a TCP reset. Option B is wrong because a mismatched ASN would cause the BGP session to be rejected after the TCP connection is established, resulting in a 'BGP Notification' or 'Open message error', not a 'Connection refused' at the TCP handshake stage. Option C is wrong because an MD5 password mismatch would still allow the TCP three-way handshake to complete; the BGP session would then fail with an authentication error (e.g., 'MD5 mismatch' or 'BGP Notification sent' after the OPEN message), not a 'Connection refused'.

Practice this question →
91
MCQhard

Your company has a Dedicated Interconnect between on-premises and Google Cloud. After a maintenance window, some routes are missing from the on-premises side. On the Cloud Router, you see that the BGP session status is 'ESTABLISHED'. However, the route table on the on-premises router does not contain any of the VPC subnets. What is the most likely cause?

A.The Cloud Router is not configured to advertise any custom routes
B.MD5 authentication is enabled but passwords differ
C.The Cloud Router has an empty 'Advertised IP ranges' list
D.BGP configuration mismatch on the on-premises router
AnswerC

If the list is empty, no prefixes are advertised.

Why this answer

The BGP session is 'ESTABLISHED', confirming that the TCP connection and BGP peering are working correctly. However, the on-premises router is not receiving any VPC subnet routes because the Cloud Router's 'Advertised IP ranges' list is empty, meaning it is not advertising any routes to the peer. This is a common misconfiguration where the Cloud Router is configured to use custom route advertisements but the list of prefixes to advertise is left blank.

Exam trap

Google Cloud often tests the misconception that an 'ESTABLISHED' BGP session guarantees that routes are being exchanged, but in reality, the session can be up while no prefixes are advertised due to missing or empty route advertisement configurations.

How to eliminate wrong answers

Option A is wrong because the Cloud Router can be configured to advertise custom routes, but the issue is that the 'Advertised IP ranges' list is empty, not that custom routes are disabled entirely. Option B is wrong because if MD5 authentication passwords differed, the BGP session would not reach the 'ESTABLISHED' state; it would remain in 'ACTIVE' or 'IDLE'. Option D is wrong because a BGP configuration mismatch on the on-premises router would typically prevent the session from establishing, but the session is 'ESTABLISHED', indicating the BGP parameters (ASN, neighbor IP, etc.) match.

Practice this question →
92
MCQmedium

A network engineer is troubleshooting a Cloud VPN gateway that is not establishing a VPN tunnel with an on-premises device. The engineer checks the Cloud VPN gateway logs and sees the error 'IKE SA negotiation failed due to mismatched authentication method'. What is the most likely cause?

A.The pre-shared keys on both ends do not match.
B.The authentication method is set to 'pre-shared key' on one side and 'certificate' on the other.
C.The VPN gateway is using the wrong external IP address.
D.The IKE version configured on the on-premises device is IKEv1 while Cloud VPN only supports IKEv2.
AnswerB

This mismatch directly causes the 'IKE SA negotiation failed due to mismatched authentication method' error.

Why this answer

The error indicates a mismatch between the authentication methods configured on both ends, such as pre-shared key vs certificate, or different authentication types.

Practice this question →
93
MCQmedium

An organization has multiple VPCs in different regions that need to connect to a single on-premises data center via Dedicated Interconnect. They want to minimize cost and complexity. What is the recommended architecture?

A.Use a single VPC and then use VPC Peering to connect to the other VPCs.
B.Use Cloud VPN for the additional VPCs to avoid additional interconnect costs.
C.Create a separate interconnect connection for each VPC.
D.Create a single interconnect connection and use multiple VLAN attachments, one per VPC.
AnswerD

One physical connection can support multiple VLAN attachments, each assigned to a different VPC.

Why this answer

A single Dedicated Interconnect connection can support multiple VLAN attachments (each with a unique VLAN ID) to connect multiple VPCs in different regions to the same on-premises data center. This minimizes cost by using one physical connection and reduces complexity by avoiding separate interconnects or VPNs for each VPC.

Exam trap

The trap here is that candidates often assume each VPC requires its own physical interconnect, but the Google Professional Cloud Network Engineer exam tests the understanding that a single Dedicated Interconnect can be partitioned into multiple VLAN attachments to serve multiple VPCs, reducing cost and complexity.

How to eliminate wrong answers

Option A is wrong because VPC Peering does not provide connectivity to an on-premises data center; it only connects VPCs within Google Cloud, and a single VPC cannot span multiple regions for Dedicated Interconnect attachments. Option B is wrong because Cloud VPN introduces additional latency and bandwidth limitations compared to Dedicated Interconnect, and it does not eliminate the need for interconnect costs if you already have a Dedicated Interconnect for the primary VPC. Option C is wrong because creating a separate interconnect connection for each VPC significantly increases cost and operational complexity, as each connection requires its own physical circuit and Google Cloud charges per connection.

Practice this question →
94
MCQmedium

Refer to the exhibit. A BGP session between a Cloud Router and an on-premises router is not establishing. The Cloud Router logs show 'BGP_OPEN_MSG_ERROR: unsupported capability'. What is the most likely issue?

A.The on-premises router cannot reach the Cloud Router's BGP IP.
B.The BGP session is stuck in the Connect state due to firewall blocking TCP port 179.
C.The BGP ASN configured on the Cloud Router doesn't match the peer.
D.The on-premises router is attempting to negotiate a BGP capability that Cloud Router does not support, such as 4-byte ASNs or IPv6 unicast.
AnswerD

Cloud Router supports only basic BGP; advanced capabilities like 4-byte ASN or IPv6 may cause this error.

Why this answer

The error message 'BGP_OPEN_MSG_ERROR: unsupported capability' indicates that during the BGP OPEN message exchange, the on-premises router advertised a BGP capability (such as 4-byte ASN support or IPv6 unicast address family) that the Cloud Router does not support. This causes the Cloud Router to reject the OPEN message and reset the session. Option D correctly identifies this mismatch in negotiated capabilities.

Exam trap

Google Cloud often tests the distinction between BGP session failures caused by TCP-level issues (firewall, reachability) versus BGP protocol-level errors (OPEN message parameters), and the trap here is that candidates confuse a generic 'BGP session not establishing' with connectivity or ASN problems, ignoring the specific error message that points to capability negotiation.

How to eliminate wrong answers

Option A is wrong because reachability issues would manifest as a TCP connection failure (session stuck in Idle or Active state), not a BGP OPEN message error. Option B is wrong because firewall blocking TCP port 179 would prevent the TCP three-way handshake entirely, resulting in a Connect or Active state, not an OPEN message error after the TCP session is established. Option C is wrong because an ASN mismatch triggers a 'BGP_OPEN_MSG_ERROR: bad peer AS' or 'BGP Notification: OPEN Message Error/2 (bad peer AS)', not an 'unsupported capability' error.

Practice this question →
95
MCQeasy

You are troubleshooting an HA VPN connection between Google Cloud and on-premises. The tunnels appear as 'UP' but no routes are exchanged. The Cloud Router logs show 'BGP session state: IDLE'. What is the most likely cause?

A.The BGP keepalive timer is set too high on the on-premises router
B.BGP is not enabled on the Cloud Router
C.Firewall rules are blocking UDP port 179
D.The on-premises BGP peer is configured with a different next-hop IP
AnswerB

Without BGP, session remains IDLE.

Why this answer

B is correct because the BGP session state IDLE indicates that BGP is not configured or enabled on the Cloud Router. Even though the IPsec tunnels are UP, no BGP routes can be exchanged if the BGP process itself is not running. In Google Cloud, you must explicitly enable BGP on the Cloud Router for each VPN tunnel; otherwise, the BGP session cannot transition from IDLE to any other state.

Exam trap

Google Cloud often tests the misconception that a BGP session stuck in IDLE is always a firewall or reachability issue, but in Google Cloud HA VPN, the most common cause is that BGP was never enabled on the Cloud Router, especially when the IPsec tunnels are UP and the candidate assumes BGP is automatically active.

How to eliminate wrong answers

Option A is wrong because a high BGP keepalive timer would cause the session to flap or time out (transition to IDLE after the hold timer expires), but the session would initially establish and show an ACTIVE or CONNECT state, not remain persistently IDLE. Option C is wrong because firewall rules blocking UDP port 179 would prevent the TCP connection for BGP (port 179 is TCP, not UDP), and the session would show CONNECT or ACTIVE, not IDLE. Option D is wrong because a different next-hop IP on the on-premises peer would affect route propagation or next-hop reachability, not the BGP session state; the session would still establish and show ESTABLISHED if the TCP connection and BGP open messages succeed.

Practice this question →
96
Drag & Dropmedium

Drag and drop the steps to configure Cloud Router with BGP for on-premises connectivity into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Cloud Router requires a router first, then a tunnel, followed by BGP configuration. Custom advertisements and verification complete the setup.

Practice this question →
97
Multi-Selecthard

You are troubleshooting a failing HA VPN tunnel between GCP and on-premises. The tunnel status shows 'Tunnel is down' in Cloud Console. Which TWO steps should you take to diagnose the issue? (Choose two.)

Select 2 answers
A.Confirm that the GCP VPC has a firewall rule allowing inbound IPsec traffic
B.Verify that the Cloud Router BGP session is established
C.Check the on-premises firewall rules to ensure UDP ports 500 and 4500 are allowed
D.Review Cloud VPN gateway logs for IKE negotiation errors
E.Ensure that the on-premises VPN gateway has a static route to the GCP VPC
AnswersC, D

IPsec uses UDP 500 for IKE and UDP 4500 for NAT traversal. Blocked ports prevent tunnel establishment.

Why this answer

Checking Cloud VPN gateway logs for IKE errors helps identify authentication or configuration mismatch. Verifying that the on-premises firewall allows UDP 500 and 4500 for IPsec is necessary because many failures are due to firewall blocking.

Practice this question →
98
MCQeasy

A company wants to connect their VPC to an on-premises network using Cloud VPN. They need to ensure that traffic from Google Cloud to on-premises uses a specific route only when the primary path is available, and otherwise fails over to a backup path. Which configuration should they use?

A.Configure Cloud NAT to route traffic through the backup path
B.Configure BGP on Cloud Router and advertise custom routes with appropriate metrics
C.Use static routes with a higher priority for the primary path
D.Create firewall rules to allow failover traffic
AnswerB

BGP allows dynamic failover and route selection based on metrics.

Why this answer

Cloud VPN with dynamic routing (BGP) allows you to control path selection by advertising custom routes with different metrics (MED values) for the primary and backup paths. When the primary path is available, the lower metric route is preferred; if the BGP session fails, the route is withdrawn and traffic automatically fails over to the backup path with a higher metric. This meets the requirement for active/passive failover without manual intervention.

Exam trap

The trap here is that candidates confuse static route priority with dynamic BGP metric-based failover, assuming that a higher-priority static route will automatically fail over when the tunnel is down, but Google Cloud static routes do not have health-check awareness and will continue to forward traffic into a dead tunnel unless the route is removed.

How to eliminate wrong answers

Option A is wrong because Cloud NAT is used for outbound internet access from private instances, not for controlling routing between a VPC and on-premises over VPN; it does not influence path selection or failover. Option C is wrong because static routes in Google Cloud have a fixed priority (lower number = higher priority), but they do not support dynamic failover based on path availability; if the primary static route is still present in the routing table, traffic will continue to use it even if the VPN tunnel is down, unless you manually remove it. Option D is wrong because firewall rules control which traffic is allowed or denied, not how traffic is routed; they cannot trigger failover or change the forwarding path.

Practice this question →
99
MCQmedium

An organization has a Dedicated Interconnect with one VLAN attachment. They want to add a second VLAN attachment on the same interconnect circuit for additional capacity. What is the correct approach?

A.Order a second physical cross-connect
B.Upgrade the existing VLAN attachment to increase bandwidth
C.Create a second VLAN attachment with a different VLAN ID
D.Create a new Cloud Router and associate it with the existing VLAN attachment
AnswerC

Multiple VLAN attachments can coexist on the same interconnect.

Why this answer

A single Dedicated Interconnect circuit can have multiple VLAN attachments (up to 8 for 10 Gbps, up to 64 for 100 Gbps). You simply create another VLAN attachment on the same interconnect, using a different VLAN ID and a different Cloud Router if desired.

Practice this question →
100
MCQmedium

A network engineer is configuring a Cloud VPN tunnel with route-based VPN and BGP. The tunnel is established, but the Cloud Router does not learn any routes from the on-premises peer. What is the most likely cause?

A.Firewall rules on the on-prem router block UDP port 179.
B.The BGP session is not configured on the VPN tunnel.
C.All of the above are possible causes.
D.The Cloud Router does not have an ASN configured.
AnswerB

The BGP session must be configured on the VPN tunnel interface. Without this configuration, the Cloud Router cannot exchange routes with the on-premises peer, making this the most likely cause.

Why this answer

The most likely cause because the BGP session must be explicitly configured on the VPN tunnel interface for route exchange. Option A is incorrect because BGP uses TCP port 179, not UDP. Option D is incorrect because a Cloud Router without an ASN would not establish a BGP session, but this is not a given in the scenario; however, the question asks for the most likely cause, and the tunnel being established suggests the VPN is up, but BGP configuration is missing.

Option C is incorrect because not all options are possible causes (A and D are not valid).

Exam trap

Google Cloud often tests the misconception that BGP uses UDP port 179 (it uses TCP), and that a VPN tunnel being 'established' automatically implies BGP is configured, when in fact BGP configuration is a separate step required for route exchange.

How to eliminate wrong answers

Option A is wrong because it is a possible cause—UDP port 179 is used by BGP for session establishment, and if blocked by on-premises firewall rules, the BGP session cannot form, so routes would not be learned. Option B is wrong because it is also a possible cause—if the BGP session is not explicitly configured on the VPN tunnel interface (e.g., using 'neighbor <peer-ip> remote-as <asn>' under the tunnel interface or BGP process), the session will not establish, and no routes will be exchanged. Option D is wrong because the Cloud Router must have an ASN configured to participate in BGP; without it, the BGP process cannot start, but this is a less likely cause in practice as Cloud Router ASN is typically set during deployment.

Practice this question →
101
MCQmedium

A company wants to use AS path prepending to influence traffic from Google Cloud to their on-premises network to prefer one Dedicated Interconnect connection over another. How should they configure AS path prepending?

A.Configure AS path prepending on the Cloud Router for the routes advertised to on-premises
B.Configure AS path prepending on the on-premises router for the routes advertised to Google Cloud
C.Configure AS path prepending on both sides equally
D.Use MED instead of AS path prepending
AnswerB

This makes the AS path longer for that connection, making it less preferred for traffic from Google Cloud.

Why this answer

AS path prepending is done on the on-premises router by adding the on-premises AS number multiple times in the BGP updates sent to Google Cloud. Google Cloud Router will then prefer the path with the shorter AS path length (fewer prepends). To make one connection less preferred, the on-premises router should prepend AS numbers on the BGP updates sent over that connection.

Practice this question →
102
Multi-Selecteasy

Which THREE components are required to set up a Partner Interconnect connection?

Select 3 answers
A.A Dedicated Interconnect connection
B.A VLAN attachment
C.A Cloud Router
D.A Cloud VPN gateway
E.The partner's network
AnswersB, C, E

The VLAN attachment is the logical connection to the partner.

Why this answer

A VLAN attachment (option B) is required because it defines the connection between your VPC and the partner's network over a Partner Interconnect, specifying the VLAN ID and IP addressing for the BGP session. Without a VLAN attachment, the Layer 2 and Layer 3 parameters for the interconnect cannot be established.

Exam trap

Google Cloud often tests the distinction between Dedicated Interconnect and Partner Interconnect, where candidates mistakenly think a Dedicated Interconnect connection is a prerequisite for Partner Interconnect, but they are mutually exclusive options for private connectivity.

Practice this question →
103
MCQhard

A company has two Dedicated Interconnect circuits in different metro areas to meet the 99.99% SLA. They have configured active-active mode. During a test, they intentionally bring down one circuit. They expect traffic to continue using the other circuit, but they notice packet loss during the failover. What could be the cause?

A.The VLAN attachments are not configured with the same Cloud Router.
B.The BGP timers are set too high, causing slow convergence.
C.The on-premises router is not configured with equal-cost multipath (ECMP).
D.The remaining circuit does not have sufficient bandwidth to handle the combined traffic load.
AnswerD

Active-active mode may use both circuits for load balancing; if one fails, all traffic goes to the other, potentially exceeding its capacity.

Why this answer

In active-active mode, both circuits are used simultaneously. When one fails, traffic is re-routed to the remaining one. If there is insufficient bandwidth on the remaining circuit, packet loss may occur due to congestion.

Practice this question →
104
Multi-Selecteasy

Which two of the following are prerequisites for configuring an HA VPN tunnel to an on-premises network? (Choose two.)

Select 2 answers
A.A VLAN attachment in the same region.
B.A Cloud Router with BGP configured in the same region as the VPN gateway.
C.A pre-shared key that is at least 20 characters long.
D.An on-premises VPN device that supports static routing only.
E.Two external IP addresses for the VPN gateway.
AnswersB, E

Cloud Router is required for BGP route exchange.

Why this answer

B is correct because an HA VPN tunnel uses dynamic routing via BGP to provide active-active or active-passive failover. A Cloud Router with BGP configured in the same region as the VPN gateway is required to exchange routes with the on-premises network, enabling automatic failover and load balancing across the two tunnels.

Exam trap

Google Cloud often tests the misconception that HA VPN requires a VLAN attachment or static routing, but the key requirement is a Cloud Router with BGP in the same region to support dynamic routing and failover.

Practice this question →
105
MCQmedium

A company needs to connect their on-premises data center to Google Cloud with a consistent, high-availability connection that offers 99.99% availability SLA. The on-premises router supports VLAN tagging and BGP. They expect to burst up to 50 Gbps peak traffic. Which interconnect solution should they choose?

A.Cloud VPN with dynamic routing
B.Dedicated Interconnect
C.Partner Interconnect
D.HA VPN
AnswerB

Dedicated Interconnect offers 99.99% SLA and supports multiple 10/40/100 Gbps connections.

Why this answer

Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, supporting up to 80 Gbps per connection (via 10 or 100 Gbps links) and offering a 99.99% availability SLA when configured with redundant links and BGP sessions. The on-premises router's support for VLAN tagging and BGP aligns perfectly with Dedicated Interconnect's requirements for 802.1Q VLANs and eBGP peering, making it the only option that meets the 50 Gbps burst requirement and high-availability SLA.

Exam trap

Google Cloud often tests the misconception that HA VPN can achieve high throughput by aggregating multiple tunnels, but in Google Cloud, each HA VPN tunnel is limited to 3 Gbps and cannot be combined to exceed that per-VPC limit, making it unsuitable for 50 Gbps bursts.

How to eliminate wrong answers

Option A is wrong because Cloud VPN with dynamic routing is limited to a maximum throughput of 3 Gbps per tunnel (using HA VPN) and does not offer a 99.99% SLA, making it insufficient for 50 Gbps peak traffic. Option C is wrong because Partner Interconnect relies on a third-party service provider's network, which introduces additional latency and typically offers a maximum of 10 Gbps per VLAN attachment, and its SLA is often lower than 99.99% due to the partner's infrastructure. Option D is wrong because HA VPN, while providing high availability with two tunnels, still caps at 3 Gbps per tunnel and cannot aggregate to 50 Gbps, and its SLA is 99.99% only for the VPN service itself, not the underlying bandwidth capacity.

Practice this question →
106
MCQmedium

A company is using Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer has created a VLAN attachment of type PARTNER_PROVIDER in Google Cloud. What must the service provider do to complete the connection?

A.Create a VLAN attachment of type PARTNER on their end and associate it with the customer's VLAN attachment.
B.Provide the engineer with a pairing key to attach the VLAN attachment to the interconnect.
C.Assign a public IP address to the VLAN attachment.
D.Configure BGP routing with the customer's on-premises router.
AnswerB

The pairing key is used by the service provider to complete the connection. This is the correct step.

Why this answer

For Partner Interconnect, the customer creates a VLAN attachment of type PARTNER (not PARTNER_PROVIDER) and gets a pairing key. The service provider uses this pairing key to connect their network to the customer's VLAN attachment. Therefore, the provider must provide the pairing key, not create a separate VLAN attachment.

Option B correctly states this.

Practice this question →
107
Multi-Selectmedium

A company is designing a highly available hybrid network using HA VPN. They need to ensure that if one VPN tunnel fails, traffic automatically fails over to the other tunnel. Which TWO configurations are required? (Choose TWO.)

Select 2 answers
A.Configure static routes for failover
B.Enable BGP on both tunnels
C.Configure both tunnels with the same peer IP address on the on-premises side
D.Use the same pre-shared key for both tunnels
E.Create two VPN tunnels, one from each Cloud VPN gateway interface
AnswersB, E

BGP allows dynamic routing and automatic failover when one tunnel goes down.

Why this answer

HA VPN requires two tunnels from two interfaces, each with its own external IP, and BGP sessions on both tunnels. The on-premises side must also have two separate peer IPs.

Practice this question →
108
MCQhard

Refer to the exhibit. A Cloud VPN tunnel is configured with the above Cloud Router configuration. The on-premises BGP peer is at 169.254.0.2 with ASN 65001. The on-premises router is receiving the route 10.0.0.0/8 from the Cloud Router, but it is not receiving any of the specific subnets (e.g., 10.1.0.0/16) that exist in the VPC. What is the most likely cause?

A.The advertised_route_priority is set too low, causing the routes to be suppressed.
B.The Cloud Router is configured with custom advertise mode and is only advertising the manually specified ranges.
C.The BGP session is not established due to ASN mismatch.
D.The on-premises peer ASN is incorrect.
AnswerB

Custom mode means only the listed ranges are advertised; VPC subnets are not included unless explicitly added.

Why this answer

The Cloud Router is configured with custom advertise mode, which means it only advertises the manually specified CIDR ranges to the on-premises BGP peer. Since the specific subnets (e.g., 10.1.0.0/16) are not included in the custom advertised ranges, the on-premises router receives only the explicitly listed 10.0.0.0/8 route, not the more specific subnets.

Exam trap

Google Cloud often tests the distinction between route advertisement control (custom vs. default mode) and route selection attributes (like priority/MED), leading candidates to incorrectly attribute missing routes to priority settings rather than advertisement configuration.

How to eliminate wrong answers

Option A is wrong because advertised_route_priority influences route selection (MED) but does not suppress route advertisement; routes are still sent regardless of priority value. Option C is wrong because if the BGP session were not established due to ASN mismatch, the on-premises router would not receive any routes at all, not just missing specific subnets. Option D is wrong because an incorrect on-premises peer ASN would prevent the BGP session from forming, which contradicts the fact that the on-premises router is already receiving the 10.0.0.0/8 route.

Practice this question →
109
MCQeasy

A company is setting up HA VPN between on-premises and Google Cloud. They have two Cloud VPN gateways with two tunnels each. They want to ensure automatic failover if one tunnel goes down. Which BGP configuration is a best practice?

A.Configure active-passive BGP with a single session.
B.Configure active-active BGP with multiple sessions using the same ASN.
C.Use policy-based routing to fail between tunnels.
D.Use static routes with a primary and backup route.
AnswerB

Active-active BGP with multiple sessions is correct in concept, but using different ASNs is not recommended; same ASN should be used for all on-premises routers to avoid asymmetric routing.

Why this answer

The best practice for HA VPN is to use active-active BGP with multiple sessions, using the same ASN on all on-premises routers. This enables ECMP and ensures symmetric routing. Option B correctly describes this configuration.

Exam trap

The trap is that candidates may think any active-active BGP configuration is correct, but details like ASN assignment matter. Using different ASNs can lead to asymmetric routing, so the same ASN must be used.

How to eliminate wrong answers

Option A is wrong because active-passive BGP with a single session creates a single point of failure; if the session or tunnel fails, there is no automatic failover to another tunnel. Option C is wrong because policy-based routing does not integrate with BGP's dynamic route advertisement and withdrawal, making failover slower and less reliable in a multi-tunnel HA VPN setup. Option D is wrong because static routes require manual intervention or complex scripting to detect tunnel failure and switch routes, whereas BGP provides automatic failover through route withdrawal.

Practice this question →
110
MCQhard

A financial institution is setting up Dedicated Interconnect with Google Cloud. They have two on-premises routers (R1 and R2) each connected to a separate Google Cloud router via VLAN attachments in two different zones (us-central1-a and us-central1-b). The on-premises routers are configured with BGP, and they advertise the corporate prefix 10.0.0.0/8. Google Cloud routers are configured with custom route advertisements. After provisioning, you notice that traffic from some on-premises subnets to GCP experiences asymmetrical routing, causing packet drops. You verify that both BGP sessions are established and that both Cloud Routers have received the 10.0.0.0/8 route. What is the most likely cause of the asymmetrical routing?

A.On-premises routers have mismatched BGP local preference values for routes received from Google Cloud
B.The on-premises routers are using the same AS number causing BGP loop prevention
C.VLAN attachments are configured with different MTU sizes
D.Cloud Router is setting different BGP metric attributes for each VLAN attachment
AnswerA

Different local preferences cause one path to be preferred for return traffic, while forward traffic may take the other path, leading to asymmetry.

Why this answer

Asymmetrical routing in a dual-homed Dedicated Interconnect setup occurs when on-premises routers have different BGP local preference values for routes received from Google Cloud. Local preference is the first BGP attribute considered when selecting the best path outbound from the on-premises network. If R1 has a higher local preference for the GCP routes than R2, all outbound traffic from on-premises will prefer R1, while return traffic from GCP may arrive via either router (depending on GCP's routing), causing a mismatch in traffic paths and packet drops.

Exam trap

Google Cloud often tests the distinction between BGP attributes that influence inbound traffic (MED, AS-path prepend) versus outbound traffic (local preference), and the trap here is that candidates may incorrectly attribute asymmetrical routing to MED or MTU issues rather than recognizing that local preference mismatch on the on-premises side is the root cause of asymmetric outbound path selection.

How to eliminate wrong answers

Option B is wrong because using the same AS number on both on-premises routers would cause BGP loop prevention only if the routers are in the same AS and the Cloud Routers see the same AS path; however, Google Cloud allows multi-homing with the same ASN by using 'allowas-in' or 'as-path prepend', and this would not directly cause asymmetrical routing—it would more likely cause route rejection or path selection issues. Option C is wrong because mismatched MTU sizes on VLAN attachments would cause fragmentation or packet drops at the link layer, not asymmetrical routing; asymmetrical routing is a Layer 3 path selection issue, not a Layer 2 MTU mismatch. Option D is wrong because Cloud Router sets BGP metric (MED) attributes per VLAN attachment only when custom route advertisements are configured with specific MED values, but MED is used to influence inbound traffic from on-premises, not outbound; asymmetrical routing here is caused by outbound path selection differences on the on-premises side, not by GCP's MED settings.

Practice this question →
111
MCQmedium

An enterprise uses HA VPN to connect their on-premises network to Google Cloud. The on-premises side has a single VPN device that supports BGP. They want to maximize availability. What is the recommended Google Cloud configuration?

A.Deploy two Cloud VPN gateways in different regions to provide regional failover.
B.Deploy a single Cloud VPN gateway with one interface and one BGP session.
C.Deploy a single Cloud VPN gateway with two interfaces, each with its own external IP, and configure two BGP sessions to the single on-premises device.
D.Deploy a single Cloud VPN gateway with two interfaces, but only use one BGP session for simplicity.
AnswerC

This provides interface-level redundancy and achieves maximal availability with a single on-premises device.

Why this answer

It provides high availability by using a single Cloud VPN gateway with two interfaces, each with its own external IP, and two BGP sessions to the on-premises device. This configuration allows active/active failover: if one interface or BGP session fails, traffic automatically switches to the other, maximizing availability without requiring multiple regions.

Exam trap

Google Cloud often tests the misconception that high availability requires multiple regions or gateways, but the trap here is that a single HA VPN gateway with dual interfaces and dual BGP sessions provides sufficient redundancy for a single on-premises device, avoiding unnecessary complexity.

How to eliminate wrong answers

Option A is wrong because deploying two Cloud VPN gateways in different regions introduces unnecessary complexity and cost; regional failover is not needed when the on-premises side has a single VPN device, and HA VPN with two interfaces on a single gateway already provides sufficient availability. Option B is wrong because a single interface and single BGP session creates a single point of failure; if the interface or BGP session goes down, connectivity is lost, which does not maximize availability. Option D is wrong because using only one BGP session with two interfaces defeats the purpose of redundancy; the second interface would remain idle and not provide automatic failover, leaving a single point of failure in the control plane.

Practice this question →
112
MCQhard

After configuring Cloud VPN with dynamic routing (BGP), you notice that on-premises routes are not appearing in Google Cloud. BGP sessions are established but no prefixes are exchanged. Cloud Router logs show: 'No route advertisement received'. On-premises BGP configuration shows 'network 10.0.0.0/8' and 'neighbor 10.1.1.1 remote-as 65000'. What is the most likely cause?

A.The 'network 10.0.0.0/8' command does not have a corresponding exact route in the on-premises routing table; also missing 'neighbor 10.1.1.1 activate' under BGP.
B.The on-premises router's BGP peer IP is not in the same subnet as the Cloud Router's interface.
C.The Cloud Router's BGP peer IP is not reachable from the on-premises router.
D.The BGP MD5 password is configured incorrectly on the on-premises router.
AnswerA

BGP requires the network to be in the routing table, and 'activate' is needed to start sending updates.

Why this answer

The on-premises BGP configuration uses the 'network 10.0.0.0/8' command, which requires an exact match in the local routing table to be advertised. Without a route for 10.0.0.0/8 (e.g., a connected or static route), BGP will not advertise it. Additionally, the 'neighbor 10.1.1.1 activate' command is missing under BGP, which is required to enable the exchange of prefixes with that neighbor.

These two issues together prevent route advertisement to Google Cloud.

Exam trap

Google Cloud often tests the misconception that an established BGP session automatically implies route exchange, but candidates must remember that the 'network' command requires an exact routing table match and that 'neighbor activate' is needed under the address family to actually send prefixes.

How to eliminate wrong answers

Option B is wrong because BGP peers do not need to be in the same subnet; they only need Layer 3 reachability, which is confirmed by the established BGP session. Option C is wrong because the BGP session is already established, indicating that the Cloud Router's BGP peer IP is reachable from the on-premises router. Option D is wrong because an incorrect MD5 password would prevent the BGP session from establishing, but the session is up, so authentication is not the issue.

Practice this question →
113
MCQeasy

A network engineer wants to monitor the operational status of a Dedicated Interconnect link using Cloud Monitoring. Which metric should they use to check if the physical link is up or down?

A.interconnect/link/operational_status
B.interconnect/network/received_bytes_count
C.vpn/tunnel/status
D.interconnect/network/packets_dropped_percent
AnswerA

This metric reports the link status: 1 for up, 0 for down.

Why this answer

The metric `interconnect/link/operational_status` directly indicates whether the physical link is up (1) or down (0).

Practice this question →
114
Multi-Selecthard

Which TWO statements about Cloud Router BGP are correct? (Choose two.)

Select 2 answers
A.Cloud Router uses multi-hop eBGP by default.
B.Cloud Router can use a private ASN.
C.Cloud Router requires a public ASN.
D.Cloud Router supports multiple BGP sessions per router.
E.Cloud Router only supports MED for routes it sends to on-premises.
AnswersB, D

Private ASN is commonly used.

Why this answer

Cloud Router can use a private ASN (64512-65534) for BGP peering, which is common when connecting to on-premises networks that do not require a public ASN. This allows flexibility in hybrid interconnectivity without needing to register a public ASN.

Exam trap

Google Cloud often tests the misconception that Cloud Router requires a public ASN or that it uses multi-hop eBGP by default, when in fact private ASNs are supported and single-hop eBGP is the default behavior.

Practice this question →
115
Multi-Selecteasy

A network engineer is configuring BGP on a Cloud Router for a Dedicated Interconnect. They want to apply traffic engineering to prefer one path over another for inbound traffic from on-premises to GCP. Which THREE BGP attributes can be used to influence this inbound traffic? (Choose three.)

Select 3 answers
A.BGP communities
B.Weight
C.AS path prepending
D.Local preference
E.MED (metric)
AnswersA, C, E

Communities can affect route preference (e.g., prepend to peers) and influence inbound traffic.

Why this answer

MED (metric) is the primary attribute to influence inbound traffic. AS path prepending (adding AS numbers) makes a path less preferred. Communities (like no-export) can control route propagation and thus influence path selection.

Practice this question →
116
MCQhard

A company has two Dedicated Interconnect connections to two separate Google Cloud regions for redundancy. They use Cloud Router with BGP to exchange routes. They want to ensure that traffic from on-premises to a specific VPC in us-central1 uses only the interconnect to us-central1, and the other interconnect is used only as a backup. How can they achieve this?

A.Configure MED values on the on-premises router to prefer the us-central1 interconnect.
B.Configure BGP communities on Google Cloud to prefer the us-central1 interconnect.
C.Configure AS path prepending on the on-premises router to make the us-central1 path longer.
D.Use Cloud Router's custom route advertisements to influence path selection.
AnswerA

Correct. By setting a lower MED on the on-premises router for routes from the us-central1 interconnect, traffic will prefer that path.

Why this answer

Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to a specific entry point. By setting a lower MED value on the on-premises router for the routes advertised via the us-central1 interconnect, the on-premises network will prefer that path for traffic destined to the VPC in us-central1. The other interconnect will only be used if the preferred path fails, providing the desired active/backup behavior.

Exam trap

Candidates often mistakenly believe that Google Cloud can influence inbound path selection via BGP communities or custom route advertisements, but these affect outbound traffic from Google Cloud. For inbound path selection, the on-premises router must set a lower MED value on the preferred interconnect.

How to eliminate wrong answers

Option B is wrong because BGP communities on Google Cloud are used to tag routes for controlling route advertisement or applying routing policies within Google's network, not to influence path selection from on-premises; the on-premises router must set the MED or other attributes. Option C is wrong because AS path prepending makes a path longer (less preferred), which would cause the on-premises router to prefer the other interconnect, not the us-central1 one. Option D is wrong because Cloud Router's custom route advertisements control which routes are advertised to on-premises, not how on-premises selects among multiple paths; path selection is determined by BGP attributes on the on-premises side.

Practice this question →
117
MCQmedium

A company has deployed Cloud HA VPN between their on-premises network and Google Cloud. They have two tunnels from the on-premises VPN appliance to the HA VPN gateway. The on-premises appliance uses a single public IP address for both tunnels, while the Cloud VPN gateway uses two different public IPs. BGP sessions are established over both tunnels, and the Cloud Router is configured with 'active/active' mode. The network team notices that all outbound traffic from Google Cloud to on-premises is using only one of the two tunnels, even though both tunnels are up. BGP metrics are identical for routes received over both sessions. What is the most likely cause?

A.The BGP sessions have different hold timers causing one to be preferred.
B.The on-premises appliance must use two different public IPs for ECMP to work.
C.The Cloud Router does not support ECMP when both BGP sessions have the same peer IP address.
D.The Cloud Router must be configured with 'active/standby' mode instead of 'active/active'.
AnswerC

Even if routes are identical, ECMP may not work if the next hop is the same; Cloud Router uses flow-based hashing that may not balance in this case.

Why this answer

Cloud Router uses the BGP peer IP address as part of the ECMP hash key. When both BGP sessions originate from the same on-premises public IP (the single IP used for both tunnels), Cloud Router sees them as the same peer and does not load-balance across them. Even though the tunnels use different Cloud VPN gateway IPs, the BGP sessions share a common peer IP, which prevents ECMP from being enabled.

Exam trap

Google Cloud often tests the misconception that ECMP requires different tunnel endpoints or different BGP metrics, when the actual requirement is that the BGP peer IP addresses must be unique for the Cloud Router to treat the sessions as separate multipath candidates.

How to eliminate wrong answers

Option A is wrong because BGP hold timers affect session stability, not route preference; identical BGP metrics mean the routes are equally preferred, and differing hold timers would not cause one tunnel to be exclusively used. Option B is wrong because ECMP can work with a single on-premises IP if the Cloud Router sees distinct BGP peer IPs; the issue is that the peer IP is the same for both sessions, not that the on-premises appliance must use two IPs. Option D is wrong because active/active mode is the correct configuration for ECMP; active/standby would intentionally use only one tunnel, which is not the desired behavior here.

Practice this question →
118
MCQeasy

A network engineer needs to test connectivity after setting up a Dedicated Interconnect VLAN attachment and BGP session. Which tool should they use to verify that Google Cloud can reach an on-premises IP address?

A.gcloud compute interconnect list command.
B.Cloud Monitoring dashboard for interconnect metrics.
C.ping and traceroute from a Google Cloud VM to the on-premises IP.
D.tcpdump on the on-premises router.
AnswerC

ping and traceroute are the standard tools for testing connectivity.

Why this answer

The standard tools to test connectivity are ping (ICMP echo) and traceroute (path discovery). They are used after BGP is established to verify end-to-end reachability.

Practice this question →
119
MCQmedium

A company currently uses a site-to-site Cloud VPN (IPsec) to connect their on-premises network to a VPC. Due to growing bandwidth demands, they plan to migrate to Partner Interconnect using a supported service provider. They have ordered a 1 Gbps connection and the provider has indicated the VLAN attachment is ready. After creating the VLAN attachment and pairing it with a Cloud Router, the on-premises router sees the BGP session come up, but no traffic is forwarded over the interconnect. The Cloud VPN is still operational. What step is most likely missing?

A.Create a VPC firewall rule to allow traffic on the VLAN attachment
B.Add a firewall rule in the VPC allowing traffic from the on-premises IP ranges on the interconnect
C.Adjust the BGP metric (MED) on the Cloud Router for the Partner Interconnect VLAN attachment to be lower than the VPN route
D.Delete the Cloud VPN tunnel and gateway to force traffic over the interconnect
AnswerC

Without explicitly setting a lower metric, the route from the VPN might be preferred; lowering the metric makes the interconnect the preferred path.

Why this answer

When both a Cloud VPN and a Partner Interconnect are connected to the same VPC, the Cloud Router will have multiple BGP routes for the same destination prefixes. By default, the VPN BGP session may have a lower MED (Multi-Exit Discriminator) or a higher local preference, causing traffic to prefer the VPN path. Lowering the MED on the VLAN attachment's BGP session makes the interconnect route more preferred, allowing traffic to be forwarded over the interconnect without deleting the VPN.

Exam trap

Google Cloud often tests the misconception that firewall rules are the missing step for traffic flow over a new interconnect, when in fact the issue is BGP route preference between parallel connections.

How to eliminate wrong answers

Option A is wrong because VPC firewall rules are stateful and apply to traffic entering or leaving VM instances, not to the VLAN attachment itself; the attachment is a Layer 2/3 construct that does not require a dedicated firewall rule. Option B is wrong because firewall rules in the VPC already exist for the on-premises IP ranges if the VPN was working; the issue is routing, not firewall filtering. Option D is wrong because deleting the Cloud VPN tunnel and gateway is unnecessary and disruptive; the correct approach is to adjust BGP path selection (e.g., MED) to prefer the interconnect route while keeping the VPN as a backup.

Practice this question →
120
Multi-Selectmedium

An enterprise is evaluating connectivity options to Google Cloud. They have moderate bandwidth requirements (up to 1 Gbps) and need high availability. Which two of the following are appropriate solutions? (Choose two.)

Select 2 answers
A.HA VPN over the internet.
B.VPC peering with a third-party network.
C.Partner Interconnect with 1 Gbps connection.
D.Classic VPN with a single tunnel.
E.Dedicated Interconnect with 10 Gbps connections.
AnswersA, C

HA VPN provides up to 1.5 Gbps per tunnel and high availability with BGP.

Why this answer

HA VPN (High-Availability VPN) uses two tunnels to two separate Cloud VPN gateways, providing automatic failover and meeting the 99.99% SLA when configured with dynamic routing (BGP). This solution supports up to 3 Gbps per tunnel pair, easily covering the 1 Gbps requirement, and uses the public internet without needing physical cross-connects.

Exam trap

Google Cloud often tests the misconception that any VPN with 'HA' in the name is automatically suitable for high availability, but the trap here is that Classic VPN (option D) lacks redundancy and BGP, while HA VPN (option A) is the correct choice; candidates may also incorrectly assume Dedicated Interconnect (option E) is always better, ignoring the bandwidth requirement and cost efficiency.

Practice this question →
121
MCQeasy

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

A.Cloud VPN with dynamic routing (BGP)
B.Ha VPN with policy-based routing
C.Dedicated Interconnect with static routing
D.Partner Interconnect with BGP
AnswerC

Dedicated Interconnect supports configuring static routes for the VLAN attachment without needing BGP.

Why this answer

Dedicated Interconnect supports static routing, which is required because the on-premises router does not support BGP. This solution provides direct, private connectivity to a single Google Cloud VPC without relying on dynamic routing protocols, making it the correct choice for this scenario.

Exam trap

Google Cloud often tests the misconception that Cloud VPN or Partner Interconnect can operate without BGP, but in Google Cloud, all VPN and Partner Interconnect solutions require BGP for dynamic routing, while Dedicated Interconnect uniquely supports static routing.

How to eliminate wrong answers

Option A is wrong because Cloud VPN with dynamic routing requires BGP, which the on-premises router does not support. Option B is wrong because HA VPN with policy-based routing is not supported in Google Cloud; HA VPN uses route-based routing with BGP. Option D is wrong because Partner Interconnect requires BGP for routing, which is incompatible with the on-premises router's static routing limitation.

Practice this question →
122
MCQmedium

An organization has established a Dedicated Interconnect to Google Cloud. They can ping instances in a VPC subnet but cannot connect to a service running on a different subnet within the same VPC. What is the most likely cause?

A.The MTU is too small.
B.The firewall rules are blocking the traffic.
C.The VLAN attachment is down.
D.The BGP routes for that subnet are not advertised.
AnswerD

If the on-premises router does not advertise the subnet via BGP, the VPC will not know how to route traffic back.

Why this answer

The Dedicated Interconnect is up and the organization can ping instances in one subnet, which confirms that Layer 2 and basic Layer 3 connectivity (via the VLAN attachment) are working. However, the inability to reach a service on a different subnet within the same VPC indicates that the on-premises router does not have a route to that specific subnet. This is most likely because the BGP session is not advertising the prefix for that subnet, or the on-premises router is not receiving the route via BGP.

Without the route, traffic from on-premises to that subnet will be dropped.

Exam trap

Google Cloud often tests the misconception that firewall rules are the default cause of connectivity issues within a VPC, but here the key clue is that ping to one subnet works, isolating the problem to route advertisement rather than security policies.

How to eliminate wrong answers

Option A is wrong because MTU issues typically cause packet fragmentation problems or connectivity failures for large packets, not a complete inability to reach a different subnet while ping (which uses small packets) works. Option B is wrong because firewall rules in Google Cloud VPC are stateful and apply to all traffic; if ping to one subnet works, firewall rules are not blocking traffic to another subnet within the same VPC (assuming similar ingress/egress rules). Option C is wrong because if the VLAN attachment were down, the organization would not be able to ping any instances in the VPC at all, as the interconnect link would be non-functional.

Practice this question →
123
Multi-Selectmedium

A company needs to connect their on-premises network to Google Cloud with high availability and load balancing across multiple tunnels. They plan to use HA VPN. Which TWO of the following are required to achieve active-active load balancing across multiple tunnels?

Select 2 answers
A.Use AS path prepending on one tunnel
B.Configure the on-premises router to enable ECMP
C.Use different MED values for each tunnel
D.Ensure the Cloud Router advertises the same routes with identical BGP attributes over all tunnels
E.Configure static routes instead of BGP
AnswersB, D

ECMP allows the router to use multiple equal-cost paths.

Why this answer

For active-active load balancing, Cloud Router BGP must advertise the same routes with identical attributes, and the on-premises router must support ECMP. Often, two tunnels are configured as a pair. The on-premises router must be configured to accept equal-cost routes.

Practice this question →
124
MCQmedium

A company is using Partner Interconnect to connect to Google Cloud. They notice that traffic from on-premises to GCP takes one path, but return traffic takes a different path, causing asymmetric routing. How can they resolve this?

A.Configure the same BGP ASN on both sides.
B.Apply BGP MED values to influence path selection.
C.Enable asymmetric routing mode on the Cloud Router.
D.Use different link-local addresses for each session.
AnswerB

MED allows you to indicate the preferred path for inbound traffic.

Why this answer

B is correct because applying BGP MED (Multi-Exit Discriminator) values allows you to influence the path selection for return traffic from Google Cloud to your on-premises network. By setting a lower MED value on one of the Partner Interconnect connections, you can make Google Cloud prefer that path for return traffic, thereby matching the forward path and resolving asymmetric routing. This is a standard BGP technique for controlling inbound traffic to an AS.

Exam trap

Google Cloud often tests the misconception that BGP ASN configuration or link-local addresses can fix routing asymmetry, when in fact only path-selection attributes like MED or AS path prepending can influence return traffic in a multi-homed BGP setup.

How to eliminate wrong answers

Option A is wrong because configuring the same BGP ASN on both sides would cause BGP to reject the session (eBGP requires different ASNs) or require allowas-in, which does not address asymmetric routing. Option C is wrong because Cloud Router does not have an 'asymmetric routing mode'; asymmetric routing is a network behavior, not a configurable mode on Cloud Router. Option D is wrong because using different link-local addresses for each session is a best practice for BGP session establishment but has no effect on path selection or routing symmetry.

Practice this question →
125
MCQeasy

Your company has two on-premises data centers, DC1 and DC2, each connected to a separate Google Cloud VPC via Dedicated Interconnect. Both VPCs are connected via VPC Network Peering. A new application deployed in VPC1 needs to communicate with a database in DC2. The database IP range is 10.0.0.0/16. You have configured firewall rules to allow the traffic. However, the application cannot reach the database. You have verified that routes for 10.0.0.0/16 exist in VPC1's route table with next hop to VPC Peering, and in VPC2's route table with next hop to the interconnect attachment. The BGP sessions on both interconnects are up. What is the most likely reason for the connectivity failure?

A.The route for 10.0.0.0/16 in VPC1 is not imported correctly from VPC Peering
B.VPC Network Peering does not support transitive routing through a peered VPC
C.BGP session on the interconnect between VPC2 and DC2 is down
D.Firewall rules in VPC2 are blocking traffic
AnswerB

VPC Peering does not allow a peered VPC to forward traffic to another network, breaking the path from VPC1 to DC2.

Why this answer

VPC Network Peering does not support transitive routing. In this topology, VPC1 is peered with VPC2, but traffic from VPC1 to DC2 must pass through VPC2 and then over the interconnect. Since VPC1's route for 10.0.0.0/16 points to the VPC peering as next hop, VPC1 expects the traffic to be forwarded directly to VPC2.

However, VPC2 cannot forward that traffic to DC2 because Google Cloud VPC peering does not allow a peered VPC to act as a transit hub; each VPC can only communicate directly with its peer, not with resources reachable through that peer. This is a fundamental limitation of VPC Network Peering, which is non-transitive.

Exam trap

The trap here is that candidates assume VPC peering behaves like a router or a traditional network switch, supporting transitive routing, when in fact Google Cloud VPC peering is strictly non-transitive and requires a separate peering or a dedicated interconnect for each VPC-to-on-premises path.

How to eliminate wrong answers

Option A is wrong because the route for 10.0.0.0/16 in VPC1 is correctly pointing to VPC Peering as the next hop, and the question states that routes exist, so import is not the issue. Option C is wrong because the BGP sessions on both interconnects are explicitly stated as up, so the interconnect between VPC2 and DC2 is functioning. Option D is wrong because firewall rules have been verified to allow the traffic, and the problem is at the routing layer, not the firewall layer.

Practice this question →
126
MCQeasy

A company needs to monitor the operational status of their Dedicated Interconnect links. Which Cloud Monitoring metric should they use?

A.interconnect/vlan_attachment/outbound_bytes
B.interconnect/network/packet_drop_count
C.interconnect/link/operational_status
D.interconnect/network/received_bytes_count
AnswerC

This metric directly indicates whether the link is up, down, or degraded.

Why this answer

The metric 'interconnect/link/operational_status' provides the operational status of each interconnect link (e.g., operational, degraded).

Practice this question →
127
MCQeasy

A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?

A.Create a custom route in the VPC pointing to the VPN appliance's internal IP.
B.Enable Private Google Access on the subnet hosting the VPN appliance.
C.Enable IP forwarding on the VPN appliance VM instance.
D.Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.
AnswerC

IP forwarding is required for the VM to act as a router.

Why this answer

A third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.

Exam trap

Google Cloud often tests the distinction between network-level configurations (routes, firewall rules) and instance-level capabilities (IP forwarding), trapping candidates who assume that creating a route or firewall rule alone is sufficient for a VM to act as a gateway.

How to eliminate wrong answers

Option A is wrong because creating a custom route pointing to the VPN appliance's internal IP is necessary for directing traffic from VPC subnets to the on-premises network, but it is not the feature that must be enabled on the appliance itself; the question asks which feature must be enabled to allow the appliance to forward traffic, and that is IP forwarding. Option B is wrong because Private Google Access enables VMs without external IPs to reach Google APIs and services, but it has no role in forwarding traffic between VPC subnets and a VPN tunnel. Option D is wrong because firewall rules control which traffic is permitted to enter or leave the VPC, but they do not enable the VM to forward packets; without IP forwarding, the VM will not forward traffic even if firewall rules allow it.

Practice this question →
128
MCQmedium

An engineer is configuring a Cloud Router for HA VPN. They need to enable BGP on the VPN tunnels. Which BGP configuration is required for the Cloud Router to advertise the VPC subnets to the on-premises network?

A.Set up a VPC peering connection
B.Use static routes on the VPN tunnel
C.Create a custom route advertisement for each subnet
D.Configure the VPN gateway to advertise the subnets
AnswerC

Cloud Router can be configured with custom route advertisements to advertise specific VPC subnets to the on-premises network via BGP.

Why this answer

Cloud Router uses Border Gateway Protocol (BGP) to dynamically exchange routes with the on-premises network over HA VPN tunnels. By default, Cloud Router advertises only the VPC subnet ranges that are directly connected to the VPC network. To ensure all VPC subnets are advertised, you must create custom route advertisements for each subnet that needs to be reachable from on-premises.

This is done by configuring the Cloud Router with a custom advertisement mode and specifying the subnet CIDR ranges as custom advertised IP ranges.

Exam trap

A common misconception in Google Cloud is that the VPN gateway itself handles BGP route advertisements, when in fact it is the Cloud Router that acts as the BGP speaker and manages route exchange for HA VPN tunnels.

How to eliminate wrong answers

Option A is wrong because VPC peering is a separate connectivity mechanism used to connect two VPC networks, not to advertise routes to an on-premises network via VPN. Option B is wrong because static routes on the VPN tunnel would require manual configuration and maintenance for each subnet, and they do not leverage BGP's dynamic route exchange, which is required for HA VPN with Cloud Router. Option D is wrong because the VPN gateway itself does not handle BGP route advertisements; that responsibility lies with the Cloud Router, which is the BGP speaker in Google Cloud.

Practice this question →
129
MCQhard

A company with limited public IP addresses on-premises needs to connect to Google Cloud using Cloud VPN. They require high availability. Which solution should they implement?

A.Use NAT to map multiple private IPs to one public IP.
B.Use Classic VPN with a single tunnel.
C.Use HA VPN with two on-premises public IPs and two tunnels.
D.Use HA VPN with the same public IP for both tunnels.
AnswerC

HA VPN provides redundancy by supporting active-active or active-passive with separate endpoints.

Why this answer

HA VPN provides high availability by using two tunnels, each terminating on a separate on-premises VPN gateway with a unique public IP address. This ensures that if one on-premises public IP or tunnel fails, traffic can still flow through the other tunnel, meeting the high-availability requirement. Classic VPN (option B) does not support active-active failover, and using the same public IP for both tunnels (option D) creates a single point of failure at the on-premises side.

Exam trap

Google Cloud often tests the misconception that HA VPN can use the same on-premises public IP for both tunnels, but in reality, each tunnel must terminate on a separate on-premises device or interface with a unique public IP to achieve true high availability.

How to eliminate wrong answers

Option A is wrong because NAT is a method for translating private IPs to a public IP for outbound internet access, not a solution for establishing a highly available VPN connection to Google Cloud. Option B is wrong because Classic VPN uses a single tunnel and a single on-premises public IP, providing no redundancy or automatic failover, thus failing the high-availability requirement. Option D is wrong because HA VPN requires two distinct on-premises public IP addresses for the two tunnels; using the same public IP for both tunnels would create a single point of failure at the on-premises gateway, negating the high-availability benefit.

Practice this question →
130
MCQmedium

A company has a HA VPN gateway in Google Cloud with two tunnels to their on-premises router. They want to ensure that if one tunnel fails, all traffic automatically fails over to the other tunnel. What configuration is necessary on the on-premises router?

A.Use AS path prepending on the primary tunnel to make it preferred
B.Set a higher local preference on the primary tunnel
C.Configure the same MED value on both tunnels
D.Configure ECMP to load balance across both tunnels
AnswerB

Higher local preference makes a route more preferred, so setting it on the primary tunnel ensures it is used when available.

Why this answer

For failover, the on-premises router should prefer one tunnel over the other using BGP attributes like local preference or AS path prepending. Typically, one tunnel is primary and the other is backup. Both tunnels should be established with BGP sessions, and the on-premises router should learn the same routes from both, but with different local preference values to determine the primary path.

Practice this question →
131
MCQmedium

A company is using Dedicated Interconnect to connect their on-premises network to Google Cloud. They have two VLAN attachments configured, each with a separate Cloud Router with active/active BGP. They want to ensure that traffic from their on-premises network to Google Cloud uses both attachments equally. Which configuration should they implement?

A.Set the same MED value on both on-premises BGP peers, and ensure the AS path length is identical.
B.Configure local preference on the Cloud Router to prefer one attachment, and rely on the other for backup.
C.Configure a single BGP session on one Cloud Router and use static routing for the other attachment.
D.Set a higher MED value on one on-premises peer to deprefer that attachment.
AnswerA

Equal MED and AS path length enables ECMP, balancing traffic across both attachments.

Why this answer

Setting the same MED (Multi-Exit Discriminator) value on both on-premises BGP peers ensures that Google Cloud's Cloud Routers, which are configured with active/active BGP, will see both paths as equally preferred. When the AS path length is also identical, the BGP best-path selection algorithm on the Cloud Routers will load-balance traffic across both VLAN attachments, achieving equal utilization. This is the standard method for enabling equal-cost multipath (ECMP) over Dedicated Interconnect with multiple attachments.

Exam trap

The trap here is that candidates often assume MED is only for influencing inbound traffic from Google Cloud to on-premises, but in this scenario, the MED values are set on the on-premises peers to influence how Google Cloud selects the return path, and equal MED is required for ECMP to work.

How to eliminate wrong answers

Option B is wrong because configuring local preference to prefer one attachment would make that attachment the primary path and the other a backup, which directly contradicts the requirement for equal traffic distribution. Option C is wrong because using a single BGP session on one Cloud Router with static routing on the other attachment would not allow dynamic load balancing; static routes lack the BGP attributes needed for equal-cost multipath, and the second attachment would only be used as a failover. Option D is wrong because setting a higher MED value on one on-premises peer would deprefer that attachment, making it less preferred and preventing equal traffic distribution; MED is a metric that influences path selection, and unequal values break ECMP.

Practice this question →
132
Multi-Selecthard

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

Select 2 answers
A.Check the MTU size on the VPN tunnel or interconnect.
B.Delete and recreate the VLAN attachment.
C.Revert all BGP routes to static routes.
D.Verify BGP timers and hold time settings.
E.Increase the bandwidth of the interconnect.
AnswersA, D

MTU mismatches can cause packet loss and BGP session drops.

Why this answer

An MTU mismatch on the VPN tunnel or interconnect can cause packet fragmentation or drops, leading to BGP session flapping. Cloud Router uses Google's internal infrastructure, and if the MTU is set too low, large BGP update packets may be silently discarded, triggering hold timer expiry and session resets. Checking and adjusting the MTU ensures that BGP packets can traverse the path without fragmentation.

Exam trap

Google Cloud often tests the misconception that increasing bandwidth or recreating attachments resolves BGP flapping, when in fact the issue is typically related to MTU mismatches or BGP timer misconfigurations that affect session stability.

Practice this question →
133
MCQmedium

A company is deploying a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They require 99.99% availability for the interconnect. Which two actions must they take to meet this SLA?

A.Order two 10 Gbps circuits in different metro areas
B.Order four 10 Gbps circuits in the same metro area
C.Order a single 10 Gbps circuit
D.Order two 10 Gbps circuits in the same metro area
AnswerA

Two circuits in different metro areas provide geo-redundancy, meeting the 99.99% SLA requirement.

Why this answer

To achieve 99.99% availability for Dedicated Interconnect, you need two connections with at least 10 Gbps each, placed in different metropolitan areas (different metro zones). This provides redundancy even if a whole metro area fails.

Practice this question →
134
MCQmedium

An organization is connecting their on-premises data center to Google Cloud via Partner Interconnect. The partner offers both Layer 2 and Layer 3 connectivity options. The organization wants to manage their own BGP sessions and IP addressing. Which connectivity option should they choose?

A.Any Layer option because they can manage BGP regardless
B.Layer 2 connectivity
C.Neither; they must use Dedicated Interconnect
D.Layer 3 connectivity
AnswerB

Layer 2 gives the customer control over BGP sessions and IP addressing.

Why this answer

With Layer 2, the service provider delivers a transparent VLAN, and the customer manages the BGP session with Google Cloud Router. Layer 3 would mean the partner manages the routing, which is not desired here.

Practice this question →
135
MCQeasy

A company wants to connect their on-premises network to Google Cloud using a VPN with high availability and 99.99% SLA. They have two Cloud VPN gateways, each with two external IP addresses. Which configuration best meets the high availability requirement?

A.Deploy two Cloud VPN gateways, each with one tunnel to one on-premises VPN device
B.Deploy two Cloud VPN gateways, each with two tunnels to two separate on-premises VPN devices
C.Deploy one Cloud VPN gateway with two tunnels to two separate on-premises VPN devices
D.Deploy one Cloud VPN gateway with one tunnel to one on-premises VPN device
AnswerB

Provides redundancy at both ends; meets 99.99% SLA.

Why this answer

It meets the 99.99% SLA requirement by deploying two Cloud VPN gateways, each with two tunnels to two separate on-premises VPN devices. This configuration provides both gateway-level redundancy and tunnel-level redundancy, ensuring that if one gateway, tunnel, or on-premises device fails, traffic can failover to another tunnel. Google Cloud's HA VPN requires at least two tunnels per gateway to achieve the 99.99% SLA, and using two separate on-premises devices eliminates the single point of failure on the customer side.

Exam trap

The trap here is that candidates often assume two gateways with one tunnel each is sufficient for high availability, but they overlook the requirement for two tunnels per gateway to meet the 99.99% SLA, as well as the need for two separate on-premises devices to avoid a single point of failure on the customer side.

How to eliminate wrong answers

Option A is wrong because deploying two Cloud VPN gateways each with only one tunnel to one on-premises VPN device creates a single point of failure on the on-premises side; if that single on-premises device fails, connectivity is lost, and the 99.99% SLA cannot be met. Option C is wrong because deploying only one Cloud VPN gateway, even with two tunnels to two on-premises devices, lacks gateway-level redundancy; if the single gateway fails, all tunnels go down, violating the high availability requirement. Option D is wrong because a single Cloud VPN gateway with a single tunnel to a single on-premises device provides no redundancy at any layer, making it impossible to achieve any meaningful SLA.

Practice this question →
136
Multi-Selectmedium

An organization is using Cloud VPN with dynamic routing and wants to improve failover time between two VPN tunnels. Which THREE configuration changes can help reduce failover time?

Select 3 answers
A.Set a lower BGP MED value on the primary tunnel
B.Increase the BGP keepalive interval to reduce overhead
C.Configure BGP timers with lower values for faster detection
D.Add static routes with a higher priority than BGP routes
E.Use multiple VPN tunnels with equal BGP metrics
AnswersA, C, E

Lower MED makes the primary path preferred, allowing faster fallback.

Why this answer

Lowering the BGP Multi-Exit Discriminator (MED) value on the primary tunnel makes it more preferred by the BGP best-path selection process. When the primary tunnel fails, BGP withdraws the route, and the backup tunnel (with a higher MED) is immediately used without waiting for timers to expire. This reduces failover time by ensuring the backup path is already known and only needs to be selected upon withdrawal.

Exam trap

Google Cloud often tests the misconception that increasing keepalive intervals improves performance, when in fact it delays failure detection and increases failover time.

Practice this question →
137
MCQmedium

A company has two Dedicated Interconnect connections from different metro areas to Google Cloud. They want to achieve a 99.99% SLA. What is the minimum requirement?

A.One Dedicated Interconnect connection with two VLAN attachments.
B.Two Dedicated Interconnect connections from different metro areas, configured for redundancy.
C.One Dedicated Interconnect and one Partner Interconnect.
D.Two Dedicated Interconnect connections in the same metro area.
AnswerB

Diverse metro areas ensure independence and meet SLA requirements.

Why this answer

To meet the 99.99% SLA, you need at least two connections that are diverse (different metro areas) and configured in active-active or active-passive mode. This ensures redundancy if one fails.

Practice this question →
138
MCQmedium

A company has a Cloud VPN tunnel with dynamic routing (BGP) connecting their on-premises network to a VPC in us-central1. They recently added a new subnet (10.2.0.0/16) to the VPC. The on-premises network still cannot reach resources in the new subnet. The Cloud Router BGP session is established and routes from on-prem are being received. What is the most likely cause?

A.The Cloud Router does not support more than 10 custom dynamic routes
B.The new subnet range is not included in the Cloud Router's advertised routes
C.BGP session is not established
D.Firewall rules are blocking traffic
AnswerB

Custom dynamic routes must be added to the Cloud Router's advertised route list for the remote peer to learn them.

Why this answer

When a new subnet is added to a VPC, the Cloud Router must be configured to advertise that subnet's CIDR range to the on-premises BGP peer. Even though the BGP session is established and routes from on-premises are received, the Cloud Router will not automatically advertise the new subnet unless its advertised route list is updated. Without the new subnet in the Cloud Router's advertised routes, the on-premises network has no path to reach 10.2.0.0/16, causing connectivity failure.

Exam trap

Google Cloud often tests the distinction between route propagation (BGP session up) and route advertisement (what prefixes are actually sent), leading candidates to incorrectly assume that an established BGP session automatically advertises all VPC subnets.

How to eliminate wrong answers

Option A is wrong because Cloud Router does not have a hard limit of 10 custom dynamic routes; it supports up to 100 custom route advertisements per VPC, and the limit is configurable via quota. Option C is wrong because the question explicitly states the BGP session is established, so a lack of session is not the issue. Option D is wrong because firewall rules control traffic filtering, not route advertisement; even if firewall rules permit traffic, the on-premises network cannot send packets to the new subnet without a route to it.

Practice this question →
139
Multi-Selectmedium

Which THREE of the following are requirements for setting up a Dedicated Interconnect connection to Google Cloud? (Choose three.)

Select 3 answers
A.A Layer 2 circuit between the on-premises router and Google's edge router.
B.A public IP address on the on-premises router for BGP peering.
C.BGP sessions must be configured directly on the VLAN attachment.
D.A physical cross-connect in a colocation facility that supports Google Cloud Interconnect.
E.A VLAN attachment (VLAN) configured in Google Cloud to connect to a VPC.
AnswersA, D, E

The connection operates at Layer 2.

Why this answer

A Dedicated Interconnect requires a Layer 2 circuit (e.g., Ethernet VLAN) that directly connects your on-premises router to a Google edge router at a colocation facility. This Layer 2 link provides the physical or virtual circuit over which BGP sessions are established to exchange routes between your network and Google Cloud.

Exam trap

Google Cloud often tests the misconception that BGP sessions are configured directly on the VLAN attachment, when in fact they are configured on the Cloud Router, which uses the VLAN attachment as the underlying Layer 2 transport.

Practice this question →
140
MCQhard

Your company has a Dedicated Interconnect with two VLAN attachments (vlan-attachment-a and vlan-attachment-b) connected to two different Edge Availability Domains (EADs) in the us-central1 region. Both attachments are associated with a single Cloud Router named 'cr-us-central1'. On-premises, you have two routers (rtr-a and rtr-b) each connected to one VLAN attachment via BGP. The Cloud Router has four BGP sessions: rtr-a (vlan-a), rtr-a (vlan-b), rtr-b (vlan-a), rtr-b (vlan-b) — a full mesh for redundancy. All sessions are established and routes are exchanged. Recently, you added a new on-premises subnet 192.168.100.0/24 and advertised it via BGP from both on-premises routers. However, Google Cloud instances in the VPC cannot reach this subnet. Other on-premises subnets (e.g., 10.0.0.0/8) are reachable. The Cloud Router route table for 'cr-us-central1' shows multiple entries for 192.168.100.0/24, each with different next hops but all with status 'stacked'. There are no BGP route filters configured. What is the most likely cause of the issue?

A.The Cloud Router has reached its maximum route limit.
B.The BGP routes have incorrect MED values causing a conflict.
C.The new subnet 192.168.100.0/24 overlaps with an existing VPC subnet.
D.The on-premises routers are not advertising the subnet with a required community tag.
AnswerC

When a learned route overlaps with a VPC subnet, the route is stacked and not used to avoid conflict.

Why this answer

When a BGP-learned route overlaps with an existing VPC subnet, Google Cloud treats it as a conflict and marks the route as 'stacked' (i.e., not active). The Cloud Router can learn the route, but it will not be installed in the VPC's effective routes because the VPC subnet prefix takes precedence. Since 192.168.100.0/24 is a private IP range that could easily overlap with a subnet in the VPC, this is the most likely cause.

Exam trap

The trap here is that candidates often assume 'stacked' routes indicate a BGP peering or route advertisement issue, when in fact it is a route conflict caused by overlapping prefixes with existing VPC subnets.

How to eliminate wrong answers

Option A is wrong because the Cloud Router has not reached its maximum route limit; if it had, the new routes would not appear at all in the route table, and other routes would also be affected. Option B is wrong because MED values influence path selection among multiple BGP paths but do not cause routes to be 'stacked' or prevent them from being installed in the VPC; conflicting MEDs would not block the route from being used. Option D is wrong because community tags are not required for BGP route acceptance on Google Cloud; the absence of a community tag does not cause routes to be marked as 'stacked' or prevent them from being used.

Practice this question →
141
MCQmedium

An on-premises router uses BGP ASN 64512. The Cloud Router is also configured with ASN 64512. When the BGP peering is established, what behavior is expected?

A.The session works but routes are not exchanged.
B.Cloud Router will automatically prepend its ASN to avoid conflict.
C.The BGP session will fail or behave unpredictably.
D.The BGP session works normally since ASN 64512 is a private ASN.
AnswerC

Same ASN on both sides causes BGP to reject the session (at least one side will see a loop).

Why this answer

BGP requires each router in a peering session to have a unique ASN to properly enforce loop prevention and path selection. When both the on-premises router and Cloud Router use the same ASN 64512, the BGP session will fail or behave unpredictably because each router will see its own ASN in received updates, triggering the BGP loop detection mechanism (RFC 4271, Section 9.3) and causing the session to drop or routes to be rejected.

Exam trap

Google Cloud often tests the misconception that private ASNs (64512-65535) are exempt from BGP loop detection, but in reality, BGP treats all ASNs equally for loop prevention, and duplicate ASNs will cause the session to fail.

How to eliminate wrong answers

Option A is wrong because the BGP session will not work normally; the duplicate ASN causes the session to fail or behave unpredictably, not just a lack of route exchange. Option B is wrong because Cloud Router does not automatically prepend its ASN to avoid conflict; ASN prepending is a manual path manipulation technique, not an automatic fix for duplicate ASN issues. Option D is wrong because even though 64512 is a private ASN, BGP loop detection still applies regardless of ASN range; the session will not work normally with duplicate ASNs.

Practice this question →
142
MCQmedium

An engineer has configured an HA VPN tunnel between an on-premises network and Google Cloud. The tunnel status shows as established, but traffic is not flowing. The engineer checks the Cloud Router BGP session and sees it is in the Active state. What is the most likely cause?

A.The tunnel's shared secret (pre-shared key) is mismatched.
B.The Cloud Router is not advertising the VPC subnet routes.
C.The on-premises router is not allowing BGP traffic on UDP port 179.
D.The Cloud Router is not configured with the correct BGP IP address for the on-premises side.
AnswerD

Incorrect peer IP is a common cause of BGP Active state.

Why this answer

The BGP session being in the Active state indicates that the Cloud Router has sent an Open message but has not received a valid response from the on-premises peer. This most commonly occurs when the BGP peer IP address configured on the Cloud Router does not match the IP address the on-premises router is using for BGP peering, preventing the TCP connection on port 179 from completing. Since the tunnel is established (IPsec is up), the issue is at the BGP layer, not the tunnel layer.

Exam trap

Google Cloud often tests the distinction between IPsec tunnel states and BGP session states, trapping candidates who assume a working tunnel means BGP must also be working, when in fact BGP has its own TCP-based connectivity requirements independent of the encrypted tunnel.

How to eliminate wrong answers

Option A is wrong because a mismatched pre-shared key would prevent the IPsec tunnel from establishing, but the question states the tunnel status is established. Option B is wrong because the Cloud Router not advertising VPC subnet routes would cause BGP to be established (Established state) but routes would be missing; the session being in Active state indicates a TCP connection failure, not a route advertisement issue. Option C is wrong because the on-premises router not allowing BGP traffic on UDP port 179 is incorrect—BGP uses TCP port 179, not UDP; blocking TCP port 179 would cause the same Active state, but the question specifies UDP, which is a protocol mismatch and thus not the most likely cause given the standard BGP behavior.

Practice this question →
143
Drag & Dropmedium

Drag and drop the steps to configure a global external HTTP(S) load balancer in Google Cloud into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Load balancer setup: backend, health check, URL map, target proxy, forwarding rule.

Practice this question →
144
Multi-Selecthard

Which TWO of the following could cause a Dedicated Interconnect BGP session to go to the 'IDLE' state?

Select 2 answers
A.Firewall rules blocking UDP port 179
B.BGP is not enabled on the Cloud Router
C.BGP keepalive timer mismatch
D.Multi-Exit Discriminator (MED) mismatch
E.Cloud Router is not configured to establish a BGP session with the on-premises peer
AnswersB, E

Correct. BGP must be enabled on the Cloud Router for a session to be established; otherwise, the session will not move out of IDLE.

Why this answer

BGP uses TCP port 179, not UDP. Blocking UDP port 179 has no effect on BGP session establishment. Options B and E are correct: BGP must be enabled on the Cloud Router, and the Cloud Router must be configured with the on-premises peer IP and ASN; otherwise, the session remains in IDLE state.

Options C and D are incorrect: keepalive timer mismatch can cause hold timer expiry but does not prevent session establishment, and MED mismatch affects path selection, not session state.

Exam trap

A common pitfall is assuming that BGP uses UDP port 179. In reality, BGP uses TCP port 179. Blocking TCP 179 would cause IDLE state, but the option specifies UDP, making it a distractor.

Practice this question →
145
MCQeasy

A company wants to resolve on-premises DNS names from Google Cloud VMs. They have a Cloud DNS private zone for their domain and on-premises DNS servers at IP 10.1.1.1 and 10.1.1.2. Which Cloud DNS feature should they use?

A.Inbound DNS policy
B.Peering zones
C.Outbound DNS forwarding using an outbound forwarding zone
D.Managed reverse lookup zones
AnswerC

An outbound forwarding zone forwards DNS queries from Google Cloud to on-premises DNS servers for a specified domain.

Why this answer

DNS forwarding zones allow Cloud DNS to forward queries for a specific domain to on-premises DNS servers.

Practice this question →
146
MCQmedium

A company is using Cloud VPN with BGP to connect their on-premises network to Google Cloud. They have two VPN tunnels from two different on-premises VPN gateways to a single Cloud VPN gateway. They notice that during maintenance on one on-premises gateway, traffic fails over to the other tunnel, but after the maintenance, traffic does not fail back. What is the most likely cause?

A.Only one VPN tunnel can be active at a time
B.The BGP local preference on the primary tunnel is not higher than the backup tunnel
C.Cloud VPN gateway does not support BGP
D.The backup tunnel does not have a valid BGP session
AnswerB

Without a higher local preference, the backup tunnel remains preferred after failover.

Why this answer

B is correct because BGP local preference is used to influence outbound traffic path selection. If the primary tunnel's local preference is not higher than the backup tunnel, BGP will not prefer the primary route after the backup session recovers, causing traffic to remain on the backup tunnel. This is a classic BGP route selection behavior where the highest local preference wins.

Exam trap

The trap here is that candidates often assume failback is automatic with BGP, but without explicit local preference tuning, BGP will not prefer the primary tunnel after recovery, leading to asymmetric traffic or persistent backup path usage.

How to eliminate wrong answers

Option A is wrong because Cloud VPN supports multiple active tunnels simultaneously with BGP, and both tunnels can be active at the same time. Option C is wrong because Cloud VPN fully supports BGP for dynamic routing, including route advertisement and selection. Option D is wrong because the backup tunnel does have a valid BGP session (traffic fails over to it), so the issue is not a missing session but rather the BGP path selection not reverting to the primary tunnel.

Practice this question →
147
MCQhard

A large enterprise has a multi-site on-premises network with two data centers (DC1 and DC2) connected via a private WAN. They are migrating critical applications to Google Cloud and have established a Dedicated Interconnect at each data center, each with a single VLAN attachment (vlan-attachment-1 from DC1, vlan-attachment-2 from DC2) connected to a single VPC network in us-central1. Each VLAN attachment uses a separate Cloud Router (router-us-central1-dc1 and router-us-central1-dc2) with BGP sessions advertising the same on-premises prefixes. The VPC has auto-mode subnet ranges. They notice that traffic from Google Cloud to on-premises is flowing only through DC1, and when DC1's interconnect fails, traffic fails over to DC2, but after DC1 recovers, traffic does not return to DC1. The on-premises routers are advertising the same prefixes with equal MED values. What is the most likely cause and the best corrective action?

A.Configure the on-premises router at DC1 to set a lower MED value for its advertised routes to make DC1 preferred
B.Change the VPC routing mode from auto to custom to force route re-evaluation
C.Disable the BGP session on DC2's Cloud Router during normal operation and re-enable it only when DC1 fails
D.On the Google Cloud Router for DC1, apply a route policy to set a higher local preference for routes learned from DC1
AnswerA

Lower MED makes DC1 preferred; after failover, when DC1 recovers, its lower MED will cause traffic to return.

Why this answer

With equal MED values from both on-premises routers, Google Cloud's Cloud Routers will prefer the first learned route and stick to it due to the default BGP best-path selection behavior (no tie-breaking based on router ID or other attributes when routes are identical). When DC1's interconnect fails, the route is withdrawn, and traffic fails over to DC2. After DC1 recovers, the route is re-advertised, but Cloud Router does not automatically preempt the existing DC2 route because the BGP best-path selection is stable and does not re-evaluate unless the current best path is withdrawn.

Setting a lower MED on DC1's advertised routes makes DC1's route more preferred, ensuring traffic returns to DC1 after recovery.

Exam trap

Google Cloud often tests the misconception that BGP automatically re-evaluates the best path when a new route is received, but in practice, BGP is stable and only switches to a new path if the current best path is withdrawn, which is why adjusting MED (or other attributes) is necessary to force traffic back to the primary link after recovery.

How to eliminate wrong answers

Option B is wrong because changing the VPC routing mode from auto to custom does not affect BGP route re-evaluation or failover behavior; it only changes how subnets are created and managed, not how dynamic routes are selected. Option C is wrong because manually disabling the BGP session on DC2's Cloud Router during normal operation defeats the purpose of having redundant connectivity and active-active load balancing; it also introduces operational complexity and potential for longer failover times. Option D is wrong because setting a higher local preference on the Google Cloud Router for DC1 would make DC1's routes more preferred, but local preference is an inbound attribute applied to routes received from BGP peers; however, Cloud Router does not support applying local preference to routes learned from on-premises—it is typically set on the on-premises side or via route policies on the Cloud Router, but the correct approach is to adjust MED on the on-premises router to influence the path selection from Google Cloud's perspective.

Practice this question →
148
MCQhard

A large enterprise has multiple on-premises data centers connected to Google Cloud via a combination of Dedicated Interconnect and Cloud VPN. They have a VPC with subnets in us-east1 and us-west1. The on-premises network advertises a prefix 10.0.0.0/8 to both Cloud Routers (each in different regions) via BGP. The Cloud Routers are configured with 'global' dynamic routing mode. The network team notices that traffic from Google Cloud instances in us-west1 to on-premises destinations in 10.0.0.0/8 is always taking the path to the closest on-premises data center (west coast) even though the west coast data center is currently under high load, causing performance degradation. The east coast data center is underutilized. They want to influence the path selection so that the west coast instances prefer the east coast data center during peak times. They are using BGP. What is the most effective method to achieve this?

A.Set a higher local preference on the west coast Cloud Router for routes received from the east coast data center.
B.Set a higher MED on the west coast data center's BGP advertisements to increase its desirability.
C.Configure the east coast data center to prepend one additional AS path hop to its advertised routes.
D.Use BGP communities to tag routes from the west coast data center under load, and configure Cloud Router to match these communities and adjust the route priority (MED) accordingly.
AnswerD

This allows dynamic adjustment: when the west coast is loaded, it tags routes with a community, and Cloud Router increases MED for those routes, making east coast more preferred.

Why this answer

BGP communities allow the west coast data center to tag its routes with a community value indicating high load. The Cloud Router can then be configured to match this community and adjust the route priority by lowering the MED (or local preference) for those routes, making the east coast data center's routes more preferred. This dynamic, policy-based approach directly addresses the need to shift traffic away from the overloaded west coast data center without manual reconfiguration.

Exam trap

The trap here is that candidates often confuse MED and local preference, thinking MED influences outbound path selection from the local AS, when in fact MED is used to influence inbound traffic from a neighboring AS, while local preference is used for outbound path selection within the AS.

How to eliminate wrong answers

Option A is wrong because setting a higher local preference on the west coast Cloud Router for routes from the east coast data center would make those routes more preferred globally (since local preference is propagated within the AS), but the question specifies influencing path selection for west coast instances specifically; local preference is an AS-wide attribute and would affect all regions, not just us-west1. Option B is wrong because MED is used to influence inbound traffic from a neighbor AS, not outbound traffic from Google Cloud to on-premises; increasing MED on the west coast data center's advertisements would make its routes less desirable for inbound traffic from Google Cloud, but the issue is about outbound path selection from Google Cloud instances. Option C is wrong because AS path prepending makes a route less preferred by artificially lengthening the AS path; prepending on the east coast data center would make its routes less attractive, which is the opposite of what is needed (we want to make east coast routes more preferred).

Practice this question →
149
MCQhard

A large e-commerce company has a hybrid cloud setup with a Dedicated Interconnect between their on-premises data center in Dallas and Google Cloud us-central1 region. They have a single VLAN attachment with a Cloud Router that uses BGP to exchange routes. The on-premises network uses 10.0.0.0/8, and Google Cloud VPC uses 172.16.0.0/16. They recently deployed a new application in us-west1 that uses IP range 172.17.0.0/16. They created a VPC peering between the us-central1 VPC and the us-west1 VPC. On-premises users can reach the us-central1 workloads but cannot reach the us-west1 application. There are no firewall rules blocking traffic. The on-premises router has a default route pointing to the Interconnect. What is the most likely cause of the issue?

A.The Cloud Router does not have routes for 172.17.0.0/16 because VPC peering does not automatically propagate routes to Cloud Router
B.BGP is not configured between Cloud Router and us-west1 VPC
C.Firewall rules in us-west1 are blocking traffic from the on-premises IP range
D.The Dedicated Interconnect is only available in us-central1 and cannot reach us-west1
AnswerA

VPC peering does not propagate routes to on-premises via Cloud Router; you must use a separate VLAN attachment or VPN in us-west1.

Why this answer

The issue is that VPC peering does not automatically propagate routes from the peered VPC (us-west1, 172.17.0.0/16) to the Cloud Router that is used for the Dedicated Interconnect. Cloud Router only learns routes that are present in the VPC’s routing table and that are explicitly advertised via BGP. Since VPC peering routes are not automatically imported into the VPC’s dynamic routing table for Cloud Router, the on-premises router never receives a route for 172.17.0.0/16, even though there are no firewall blocks.

Exam trap

The trap here is that candidates assume VPC peering automatically makes all peered networks reachable from on-premises via the Interconnect, forgetting that Cloud Router only advertises routes that are explicitly in the VPC’s routing table and not those learned through peering unless custom advertisement is set up.

How to eliminate wrong answers

Option B is wrong because BGP is configured between the Cloud Router and the on-premises router, not between Cloud Router and the us-west1 VPC; VPC peering does not involve BGP. Option C is wrong because the question explicitly states there are no firewall rules blocking traffic, so firewall rules in us-west1 are not the cause. Option D is wrong because a Dedicated Interconnect in us-central1 can reach us-west1 via Google’s internal network; the limitation is not geographic but rather the lack of route propagation from the peered VPC to the Cloud Router.

Practice this question →
150
MCQhard

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They notice that traffic from Google Cloud to on-premises is not using the VPN tunnel but instead going through the internet. They have verified that the VPN tunnel is up and BGP sessions are established. Which configuration issue is most likely causing this behavior?

A.The Cloud Router BGP IP address is misconfigured
B.The pre-shared key for the VPN tunnel is mismatched
C.The on-premises BGP ASN is incorrect
D.The on-premises router is not advertising the on-premises CIDR via BGP
AnswerD

Without the route advertisement, Google Cloud cannot route traffic to on-premises via the VPN.

Why this answer

If the on-premises router does not advertise the on-premises CIDR via BGP, the Cloud Router will not have a route to that network in its routing table. Even though the VPN tunnel is up and BGP sessions are established, without the specific prefix being advertised, Google Cloud will use its default route (0.0.0.0/0) to send traffic to on-premises over the internet instead of through the VPN tunnel.

Exam trap

The trap here is that candidates assume a working VPN tunnel and established BGP session guarantee traffic flows correctly, but they overlook the critical requirement that the on-premises CIDR must be explicitly advertised via BGP for Cloud Router to install a specific route over the VPN.

How to eliminate wrong answers

Option A is wrong because a misconfigured Cloud Router BGP IP address would prevent the BGP session from establishing, but the question states BGP sessions are established. Option B is wrong because a mismatched pre-shared key would cause the IPsec tunnel to fail to come up, but the question confirms the VPN tunnel is up. Option C is wrong because an incorrect on-premises BGP ASN would cause the BGP session to fail to establish or be rejected, but the question explicitly states BGP sessions are established.

Practice this question →
← PreviousPage 2 of 3 · 212 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Implementing Hybrid Interconnectivity questions.

Start 20-question session