Knowledge + Practice

CCNA Implementing Hybrid Interconnectivity Questions

62 of 212 questions · Page 3/3 · Implementing Hybrid Interconnectivity · Answers revealed

Practice these questions Domain overview All questions

151

MCQeasy

A company is using Partner Interconnect with a service provider that requires the use of VLAN attachments. Which type of VLAN attachment should they create in Google Cloud to use the partner's connection?

A.DEDICATED

B.PARTNER

C.PARTNER_PROVIDER

D.CUSTOMER

AnswerB

PARTNER is the correct type for customer-managed VLAN attachments in Partner Interconnect.

Why this answer

For Partner Interconnect, you create a VLAN attachment of type PARTNER. This attachment represents the logical connection to the partner's network. The partner can also use PARTNER_PROVIDER type if they manage the attachment, but from the customer side, it's PARTNER.

Practice this question →

152

MCQhard

A company has a Partner Interconnect connection (Layer 2) with a service provider. They need to configure BGP sessions on their on-premises router and Google Cloud Router. The engineer creates a VLAN attachment of type PARTNER. However, the BGP session does not come up. What is the most likely reason?

A.The Cloud Router BGP IP address is not in the same subnet as the VLAN attachment

B.The VLAN attachment type should be PARTNER_PROVIDER

C.The IAM permissions for the Cloud Router are missing

D.The on-premises router is using a different BGP AS number than configured

AnswerA

The BGP IP addresses on Cloud Router and on-premises must be in the same /29 subnet assigned by the VLAN attachment.

Why this answer

In Layer 2 Partner Interconnect, the customer must configure BGP sessions. The VLAN attachment type PARTNER requires the customer to manage BGP. Common issues include incorrect VLAN ID or IP addresses.

Practice this question →

153

MCQmedium

A company has set up a route-based HA VPN tunnel between Google Cloud and their on-premises network. They are experiencing packet loss and need to troubleshoot. Which logs or metrics would provide the MOST relevant information to diagnose the issue?

A.Cloud Monitoring metric: interconnect/network/received_bytes_count

B.Cloud Load Balancing logs

C.VPC flow logs

D.Cloud VPN gateway logs (syslog)

AnswerD

Gateway logs contain detailed information about the VPN tunnels.

Why this answer

Cloud VPN gateway logs provide detailed information about tunnel establishment, IKE negotiations, and BGP messages. They can help identify packet loss causes like MTU issues, encryption mismatches, or routing problems. Cloud Monitoring metrics for VPN tunnels show traffic volume and errors, but logs provide more granular detail.

Practice this question →

154

MCQhard

A company uses Partner Interconnect with a service provider that offers Layer 2 connectivity. The engineer needs to establish BGP peering between the on-premises router and Cloud Router. What must be created in Google Cloud to enable this?

A.An HA VPN gateway.

B.A VLAN attachment of type PARTNER_PROVIDER.

C.A Dedicated Interconnect attachment.

D.A VLAN attachment of type PARTNER.

AnswerB

PARTNER_PROVIDER is used when the partner provides Layer 2 connectivity.

Why this answer

With Layer 2 Partner Interconnect, the service provider extends a VLAN to Google. You create a VLAN attachment of type PARTNER_PROVIDER, which allows you to configure the Cloud Router and BGP session.

Practice this question →

155

MCQeasy

A company needs to connect multiple on-premises sites to Google Cloud using a single Cloud VPN gateway. What is the recommended approach?

A.Create a single VPN tunnel and use policy-based routing to direct traffic.

B.Use a single VPN tunnel with multiple BGP sessions.

C.Create multiple VPN tunnels, each with its own BGP session to a Cloud Router.

D.Create a single VPN tunnel and use static routes for each site.

AnswerC

This allows each site to have its own encrypted tunnel and dynamic routing.

Why this answer

When connecting multiple on-premises sites to Google Cloud using a single Cloud VPN gateway, the recommended approach is to create multiple VPN tunnels, each with its own BGP session to a Cloud Router. This allows the Cloud VPN gateway to terminate multiple tunnels, and each tunnel can have a unique BGP session for dynamic route exchange, enabling the gateway to learn and advertise routes for each site independently. Using a single tunnel with multiple BGP sessions or policy-based routing is not supported because a Cloud VPN tunnel is a point-to-point connection that can only have one BGP session per tunnel, and static routes would not provide the redundancy or dynamic failover needed for multiple sites.

Exam trap

Google Cloud often tests the misconception that a single VPN tunnel can support multiple BGP sessions or that policy-based routing can be used to segregate traffic for multiple sites, but in Google Cloud, each tunnel is a point-to-point construct that requires its own BGP session, and policy-based routing is not available for Cloud VPN.

How to eliminate wrong answers

Option A is wrong because policy-based routing is not a supported feature for Cloud VPN tunnels; Cloud VPN uses route-based VPNs (with BGP or static routes) and cannot direct traffic based on policies across multiple sites through a single tunnel. Option B is wrong because a single VPN tunnel can only have one BGP session; multiple BGP sessions cannot be established over a single tunnel as each BGP session requires a separate tunnel interface and peer IP address. Option D is wrong because using a single VPN tunnel with static routes for each site would create a single point of failure and cannot provide the dynamic routing, failover, or load balancing needed for multiple on-premises sites; static routes also require manual updates if site topologies change.

Practice this question →

156

Matchingmedium

Match each VPC networking concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Regional IP range within a VPC

Connection between two VPCs for private IP communication

VPC from one project shared with other projects

Outbound internet access for private instances

Access Google APIs from on-premises or other clouds

Why these pairings

VPC is global, subnets are regional. Firewall rules filter traffic, routes determine paths. Common confusions: swapping global/regional or filtering/routing.

Practice this question →

157

MCQeasy

A company is deploying a hybrid cloud solution using Partner Interconnect. They have ordered a 1 Gbps connection from a partner at a colocation facility. The on-premises network uses a 10 Gbps link to the colo, and the partner provides a single 1 Gbps connection to Google Cloud. The company wants to connect two separate VPC networks in Google Cloud (production and development) to their on-premises network. Each VPC requires 500 Mbps of dedicated bandwidth. The company also needs high availability for the connection. What should they do?

A.Create a single VLAN attachment, then use a shared VPC with two subnets. Configure one Cloud Router with two BGP sessions, one for each subnet.

B.Create one VLAN attachment with 1 Gbps capacity, attach it to both VPCs using a single Cloud Router with two BGP sessions.

C.Create two VLAN attachments on the same interconnect, each with 500 Mbps capacity. Configure a separate Cloud Router for each VPC, each with a BGP session on its respective VLAN attachment. Use BGP metrics for active/passive failover.

D.Order two separate 1 Gbps Partner Interconnect connections, one for each VPC, and configure each with a single VLAN attachment.

AnswerC

Correct. This meets bandwidth and HA requirements.

Why this answer

Partner Interconnect supports multiple VLAN attachments on a single connection, each with its own capacity allocation. By creating two VLAN attachments with 500 Mbps each, you can dedicate bandwidth to each VPC while meeting the 500 Mbps requirement. Using separate Cloud Routers with BGP sessions on each VLAN attachment and adjusting BGP metrics (e.g., local preference) allows active/passive failover for high availability, satisfying both the bandwidth and HA needs without requiring additional physical connections.

Exam trap

The trap here is that candidates assume a single VLAN attachment can serve multiple VPCs or that multiple physical connections are required for multiple VPCs, but Partner Interconnect allows multiple VLAN attachments on one connection, each dedicated to a different VPC with its own bandwidth and BGP session.

How to eliminate wrong answers

Option A is wrong because a single VLAN attachment cannot be shared across two separate VPC networks; VLAN attachments are per-VPC resources, and using a shared VPC with subnets does not provide dedicated bandwidth per VPC or proper isolation. Option B is wrong because a single VLAN attachment cannot be attached to two VPCs simultaneously; each VLAN attachment is associated with exactly one VPC and one Cloud Router, and a single Cloud Router with two BGP sessions cannot route traffic to two different VPCs over the same attachment. Option D is wrong because ordering two separate 1 Gbps connections is unnecessary and cost-prohibitive; a single 1 Gbps Partner Interconnect connection can support multiple VLAN attachments (up to 8 per connection) to serve multiple VPCs with dedicated bandwidth.

Practice this question →

158

Multi-Selectmedium

An organization needs low-latency connectivity between their on-premises data center and Google Cloud, supporting up to 20 Gbps throughput. They already have a Partner Interconnect connection but need to increase capacity. Which two actions should they take? (Choose two.)

Select 2 answers

A.Work with the service provider to upgrade the existing interconnect to a higher capacity

B.Create additional Cloud VPN tunnels to the same region

C.Provision a new Dedicated Interconnect to bypass the partner

D.Provision additional VLAN attachments on the existing Partner Interconnect

AnswersA, D

Partner Interconnect bandwidth can be upgraded with provider.

Why this answer

Partner Interconnect connections can be upgraded to higher capacity by working with the service provider, as the provider manages the underlying physical circuit. This allows increasing throughput up to 20 Gbps without replacing the existing connection, leveraging the existing Layer 2 or Layer 3 handoff.

Exam trap

Google Cloud often tests the misconception that adding Cloud VPN tunnels can scale throughput to match Interconnect speeds, but VPN tunnels have lower bandwidth limits and higher latency, making them unsuitable for high-throughput, low-latency requirements.

Practice this question →

159

Multi-Selectmedium

A company has two Dedicated Interconnect connections from different metro areas to their GCP VPC. They want to use both connections actively (active-active load balancing) without manual intervention. Which TWO configurations are required to achieve this? (Choose two.)

Select 2 answers

A.Use AS path prepending on one of the BGP sessions

B.Advertise the same on-premises prefix with the same MED on both BGP sessions

C.Configure ECMP on the Cloud Router

D.Create two separate Cloud Routers

E.Set different MED values on each BGP session

AnswersB, C

Equal MED ensures both paths are considered equal by BGP, enabling ECMP.

Why this answer

To use active-active, you must configure ECMP on the Cloud Router to load balance across both BGP sessions, and advertise the same prefixes with equal priority (same MED) from both on-premises routers.

Practice this question →

160

MCQeasy

A company is deploying a Dedicated Interconnect with a 10 Gbps circuit to Google Cloud. They need to ensure high availability. Which configuration is required by Google Cloud to meet the high availability SLA?

A.Combine Dedicated Interconnect with a Cloud VPN tunnel for failover

B.Use Partner Interconnect instead of Dedicated Interconnect

C.Provision two VLAN attachments on two separate Cloud Routers in different zones

D.Provision a single VLAN attachment on one Cloud Router

AnswerC

Two VLAN attachments in different zones provide redundancy and meet the HA SLA.

Why this answer

To meet the high availability SLA for Dedicated Interconnect, Google Cloud requires at least two VLAN attachments, each on a separate Cloud Router in different zones. This ensures that if one zone or Cloud Router fails, traffic can still flow through the other attachment, providing redundancy. A single VLAN attachment or a single Cloud Router does not meet the 99.99% availability SLA because it creates a single point of failure.

Exam trap

The trap here is that candidates often think a single Cloud Router with multiple VLAN attachments is sufficient, but Google Cloud requires the Cloud Routers themselves to be in different zones to avoid a single point of failure at the zone level.

How to eliminate wrong answers

Option A is wrong because combining Dedicated Interconnect with a Cloud VPN tunnel is not a required configuration for the high availability SLA; while it can provide a backup path, the SLA specifically requires redundant VLAN attachments on separate Cloud Routers in different zones. Option B is wrong because Partner Interconnect is an alternative connectivity option, not a requirement for high availability; the SLA for Dedicated Interconnect is met with redundant VLAN attachments, not by switching to Partner Interconnect. Option D is wrong because a single VLAN attachment on one Cloud Router creates a single point of failure and does not meet the high availability SLA, which mandates at least two attachments in different zones.

Practice this question →

161

Multi-Selecteasy

An organization is considering using Partner Interconnect to connect to Google Cloud. They want the service provider to manage the BGP sessions. Which TWO configurations must they choose? (Choose TWO.)

Select 2 answers

A.Select Layer 2 connectivity option with the provider

B.Create VLAN attachment of type PARTNER_PROVIDER

C.Select Layer 3 connectivity option with the provider

D.Create VLAN attachment of type PARTNER

E.Configure BGP sessions on the Cloud Router

AnswersB, C

PARTNER_PROVIDER is used when the provider manages BGP.

Why this answer

For Layer 3 connectivity where the provider manages BGP, the VLAN attachment type must be PARTNER_PROVIDER, and the provider handles BGP.

Practice this question →

162

MCQmedium

A company needs to connect their on-premises data center to Google Cloud using Dedicated Interconnect. They have a service level agreement that requires 99.99% availability for the connection. What is the minimum number of VLAN attachments they must provision, and how should they be configured to meet this SLA?

A.One VLAN attachment with a single Interconnect

B.Two VLAN attachments, each on a different Interconnect

C.Four VLAN attachments on two Interconnects

D.Two VLAN attachments on the same Interconnect

AnswerB

Two VLAN attachments on redundant Interconnects provide the required availability.

Why this answer

To achieve 99.99% availability for Dedicated Interconnect, you must eliminate single points of failure. A single VLAN attachment on one Interconnect (Option A) provides no redundancy. Google Cloud requires at least two VLAN attachments, each on a different Interconnect (and ideally different edge availability domains), to meet this SLA.

This ensures that if one Interconnect or VLAN attachment fails, traffic can fail over to the other, maintaining connectivity.

Exam trap

Google Cloud often tests the misconception that two VLAN attachments on the same Interconnect provide redundancy, but the trap here is that they share the same physical link and edge availability domain, so a single failure takes down both attachments.

How to eliminate wrong answers

Option A is wrong because a single VLAN attachment on one Interconnect creates a single point of failure; Google Cloud's 99.99% SLA for Dedicated Interconnect requires redundant connections across at least two separate Interconnects. Option C is wrong because four VLAN attachments on two Interconnects exceed the minimum requirement; two VLAN attachments (one per Interconnect) are sufficient to meet the 99.99% SLA, and adding more does not increase availability beyond the SLA. Option D is wrong because two VLAN attachments on the same Interconnect share the same physical link; if that Interconnect fails, both attachments go down, so this configuration does not provide the required redundancy.

Practice this question →

163

MCQmedium

A network engineer is setting up a Dedicated Interconnect between an on-premises network and Google Cloud. After the circuit is ordered and the physical connection is established at the co-location facility, what is the first step to configure the interconnect inside GCP?

A.Configure a VPN tunnel for backup connectivity.

B.Create a VLAN attachment to associate with the interconnect.

C.Enable Cloud NAT for outbound traffic.

D.Create a Cloud Router with BGP sessions.

AnswerB

A VLAN attachment is the first logical configuration step after the physical connection.

Why this answer

After the physical connection is ready, you must create a VLAN attachment in Google Cloud to define the connection between your VPC and the interconnect.

Practice this question →

164

Multi-Selectmedium

Your organization uses Cloud DNS for private DNS resolution within GCP. You need to enable on-premises DNS servers to resolve GCP private zone names (e.g., myinstance.internal.example.com). Which TWO resources must you configure? (Choose two.)

Select 1 answer

A.Configure an outbound DNS server policy in GCP

B.Create a DNS peering zone in Cloud DNS that points to the on-premises DNS servers

C.Configure an inbound DNS server policy in GCP

D.Set up a VPN tunnel between GCP and on-premises

E.Create a forwarding zone in Cloud DNS

AnswersC

An inbound DNS server policy creates a forwarding endpoint with a Google-managed IP. On-premises DNS servers forward queries for the private zone to this IP, enabling resolution.

Why this answer

To allow on-premises DNS servers to resolve GCP private zone names, you only need to configure an inbound DNS server policy (option C). This creates a forwarding endpoint with a Google-managed IP address in a VPC network. On-premises DNS servers must then be configured to forward queries for the private zone to that IP address.

A DNS peering zone (option B) is not required because the inbound endpoint can resolve records in any private zone that is in the same project and VPC network. The other options (A, D, E) are not relevant for this use case.

Exam trap

Candidates often think a DNS peering zone is necessary to connect on-premises DNS to GCP private zones, but the inbound DNS server policy alone is sufficient. The on-premises servers just need to forward queries to the Google-managed IP.

Practice this question →

165

MCQhard

An engineer configures an HA VPN with two tunnels to an on-premises network using IKEv2 and pre-shared keys. After configuration, the tunnels show as established, but no traffic flows. The Cloud Router BGP sessions are not established. The on-premises firewall logs show IKE packets are being sent but no response. What is the most likely cause?

A.The Cloud Router BGP AS number is duplicated

B.The pre-shared keys do not match

C.The on-premises firewall is blocking UDP port 500

D.The VPN tunnel is configured as policy-based instead of route-based

AnswerB

Mismatched pre-shared keys would cause IKE negotiation to fail, resulting in no response from Google side.

Why this answer

B is correct because the on-premises firewall logs show IKE packets being sent but no response, which indicates that the IKEv2 pre-shared key mismatch causes the IKE authentication phase to fail. Even though the tunnel status shows as established (likely due to a stale or misconfigured status check), the BGP sessions cannot form because the IKE security association (SA) is not fully authenticated, preventing the IPsec SA from being created and thus blocking all traffic, including BGP packets.

Exam trap

In Google Cloud HA VPN, the tunnel status may show as established after IKE_SA_INIT but before full authentication. Candidates often mistakenly assume that the IPsec SA is up, but the pre-shared key mismatch prevents full authentication and IPsec SA creation, which is why BGP sessions fail despite the tunnel status indicating established.

How to eliminate wrong answers

Option A is wrong because a duplicate Cloud Router BGP AS number would cause BGP session flapping or rejection, but it would not prevent IKE packets from receiving a response; the IKE phase would still complete successfully. Option C is wrong because if the on-premises firewall were blocking UDP port 500, the firewall logs would show IKE packets being dropped or no packets at all, not 'IKE packets are being sent but no response' (the packets are sent, but the response is missing due to authentication failure). Option D is wrong because a policy-based tunnel would still allow IKE to establish and BGP to form if the correct policies are in place; the issue here is specifically at the IKE authentication layer, not the tunnel type.

Practice this question →

166

MCQhard

You have set up a Dedicated Interconnect with two VLAN attachments (each 10 Gbps) and configured ECMP on the Cloud Router. You observe that traffic from on-premises to a specific VM is only using one attachment. What is the most likely cause?

A.Route propagation is disabled on one Cloud Router interface

B.One of the VLAN attachments has a higher route priority

C.BGP ASN mismatch between the two attachments

D.The traffic consists of a single flow that is hashed to one attachment

AnswerD

ECMP per-flow hashing keeps each flow to one path.

Why this answer

D is correct because ECMP (Equal-Cost Multi-Path) relies on hashing of packet headers (e.g., 5-tuple: source/destination IP, protocol, source/destination port) to select a path. A single flow (e.g., a TCP connection between two specific IPs and ports) will always hash to the same attachment, so it cannot use both VLAN attachments simultaneously. This is expected behavior, not a fault.

Exam trap

Google Cloud often tests the misconception that ECMP should load-balance every packet across all links, but the trap here is that ECMP operates on a per-flow basis (not per-packet) to avoid packet reordering, so a single flow will always use only one path.

How to eliminate wrong answers

Option A is wrong because route propagation is a BGP setting that controls whether learned routes are advertised to VPC networks; if disabled on one interface, routes would be missing entirely, not just for a single flow. Option B is wrong because route priority (e.g., MED, local preference) affects which route is preferred for a prefix, but both attachments have equal cost (same bandwidth, same AS path length), so priority does not cause single-flow behavior. Option C is wrong because an ASN mismatch would prevent BGP peering from establishing at all, causing complete loss of connectivity on that attachment, not selective use of one attachment for a single flow.

Practice this question →

167

MCQeasy

When setting up a Partner Interconnect, which Google Cloud resource is used to connect to the partner's network?

A.Cloud VPN gateway

B.Cloud Interconnect attachment

C.VLAN attachment

D.Cloud Router

AnswerC

A VLAN attachment is the logical connection between Google Cloud and the partner's network.

Why this answer

When setting up a Partner Interconnect, the correct Google Cloud resource is a VLAN attachment. This attachment is provisioned on a Cloud Interconnect connection that is managed by a supported service provider, and it defines the VLAN and the Cloud Router configuration used to exchange routes via BGP. The VLAN attachment is the logical construct that connects your VPC network to the partner's network through the partner's physical infrastructure.

Exam trap

Google Cloud often tests the distinction between the physical connection (Dedicated Interconnect or Partner Interconnect) and the logical attachment (VLAN attachment), so candidates mistakenly select 'Cloud Interconnect attachment' as a generic term instead of the precise 'VLAN attachment' resource name used in Google Cloud.

How to eliminate wrong answers

Option A is wrong because Cloud VPN gateway is used for IPsec VPN tunnels over the public internet, not for dedicated or partner-managed physical interconnections. Option B is wrong because 'Cloud Interconnect attachment' is not a specific Google Cloud resource; the correct term is 'VLAN attachment' which is the attachment created on a Dedicated or Partner Interconnect connection. Option D is wrong because Cloud Router is a dynamic routing appliance that exchanges BGP routes over the VLAN attachment, but it is not the resource that directly connects to the partner's network—the VLAN attachment is the connection point.

Practice this question →

168

MCQhard

A network engineer is troubleshooting connectivity between an on-premises network and Google Cloud. The on-premises router has two BGP sessions configured for redundancy with a Cloud Router. The engineer runs the command above. Which issue does the output indicate?

A.Both BGP sessions are down

B.The BGP session for peer-a is down

C.The on-premises router is not advertising any routes to the Cloud Router

D.The Cloud Router is not advertising any routes to on-premises

AnswerC

learnedRoutes is empty for peer-a, indicating no routes received from on-premises.

Why this answer

The output shows that both BGP sessions are established (state = Established), so options A and B are incorrect. However, the 'Received routes' count is 0 for both peers, meaning the on-premises router is not sending any routes to the Cloud Router. This prevents the Cloud Router from learning the on-premises prefixes, breaking connectivity from Google Cloud to on-premises.

Exam trap

The trap here is that candidates see 'Established' sessions and assume full connectivity, overlooking that BGP session up does not guarantee routes are being exchanged, which is the actual root cause of the connectivity failure.

How to eliminate wrong answers

Option A is wrong because the BGP session state for both peers is 'Established', indicating the TCP connection and BGP session are up, not down. Option B is wrong because peer-a's session state is also 'Established', so it is not down. Option D is wrong because the 'Advertised routes' count is non-zero (e.g., 5 for peer-a), showing the Cloud Router is sending routes; the issue is with received routes, not advertised routes.

Practice this question →

169

MCQeasy

A company has a Dedicated Interconnect with one 10 Gbps connection. They need high availability for critical workloads. Which design is the best practice according to Google Cloud recommendations?

A.Provision a second Dedicated Interconnect connection to a different PoP.

B.Add a second connection to the same PoP using the same provider.

C.Rely on the single connection and monitor for failures.

D.Use Cloud VPN as a backup to the Dedicated Interconnect.

AnswerA

Connections to different PoPs provide geographic redundancy and higher availability.

Why this answer

Google Cloud best practice for high availability with Dedicated Interconnect requires at least two physical connections, each to a different edge point of presence (PoP), to eliminate single points of failure at the network edge. A single 10 Gbps connection, even with a backup VPN, does not provide the same SLA or bandwidth guarantees for critical workloads. Option A ensures that if one PoP or provider fails, the other connection can maintain connectivity.

Exam trap

The trap here is that candidates often assume a second connection to the same PoP or a VPN backup is sufficient for high availability, but Google Cloud explicitly requires diverse PoPs to protect against facility-level failures, and VPN backup lacks the bandwidth and SLA for critical workloads.

How to eliminate wrong answers

Option B is wrong because adding a second connection to the same PoP using the same provider still creates a single point of failure at that PoP; both connections share the same physical location and provider infrastructure, so an outage at that PoP or provider will take down both links. Option C is wrong because relying on a single connection with monitoring does not provide high availability; any failure of that single link will cause downtime for critical workloads, and Google Cloud recommends at least two connections for HA. Option D is wrong because Cloud VPN as a backup to Dedicated Interconnect does not provide the same bandwidth (typically limited to 3 Gbps per tunnel) or latency guarantees, and it introduces additional encryption overhead; it is suitable for lower-bandwidth or non-critical failover, not for maintaining 10 Gbps throughput for critical workloads.

Practice this question →

170

MCQeasy

A company wants to establish a dedicated physical connection between their on-premises network and Google Cloud. They need a 10 Gbps connection and are willing to manage the circuit and colocation facility themselves. Which Google Cloud service should they use?

A.Dedicated Interconnect

B.Partner Interconnect

C.Cloud CDN

D.Cloud VPN

AnswerA

Dedicated Interconnect provides a direct physical connection up to 10 Gbps (or 100 Gbps) and requires the customer to manage circuit ordering and colocation.

Why this answer

Dedicated Interconnect provides a direct physical connection between the on-premises network and Google's network via a colocation facility and Google Partner PoP. It is managed by the customer for circuit ordering and colocation.

Practice this question →

171

Multi-Selecteasy

Which TWO of the following are benefits of using Cloud Interconnect over Cloud VPN for hybrid connectivity? (Choose two.)

Select 2 answers

A.Lower and more consistent latency.

B.Always provides encryption for data in transit.

C.Easier to set up as no physical connection is needed.

D.Lower cost for small bandwidth requirements.

E.Higher bandwidth capacity (up to 80 Gbps per circuit).

AnswersA, E

Dedicated connections avoid internet variability.

Why this answer

Cloud Interconnect provides a dedicated, private connection between your on-premises network and Google Cloud, bypassing the public internet. This results in lower and more consistent latency compared to Cloud VPN, which relies on the public internet and is subject to variable network conditions and potential congestion.

Exam trap

Google Cloud often tests the misconception that Cloud Interconnect provides encryption by default, when in fact it does not; the trap is that candidates confuse the private nature of the connection with inherent security, forgetting that encryption must be separately implemented.

Practice this question →

172

MCQmedium

A company has a Cloud VPN between their on-premises network and Google Cloud. They want to ensure that traffic flows symmetrically, meaning that traffic from Google Cloud to on-premises uses the same VPN tunnel as traffic from on-premises to Google Cloud. Which best practice should they implement?

A.Use dynamic routing with BGP and ensure that the AS path length is the same on both sides.

B.Implement policy-based routing that forces traffic to and from specific subnets to use the same tunnel.

C.Deploy multiple VPN tunnels and use different priorities for each.

D.Use static routes pointing to the VPN tunnel on both sides.

AnswerB

Policy-based routing can enforce symmetric flows.

Why this answer

Policy-based routing (PBR) allows you to explicitly define forwarding rules based on source/destination IP addresses, ensuring that traffic from Google Cloud to on-premises uses the same VPN tunnel as the reverse direction. This enforces symmetric flow, which is critical for stateful firewalls and NAT devices that expect packets to arrive on the same interface they left. Dynamic routing (BGP) or static routes alone do not guarantee symmetry unless combined with PBR or tunnel interface configurations.

Exam trap

Google Cloud often tests the misconception that dynamic routing protocols like BGP inherently provide symmetric routing, but in reality, BGP only controls the best path selection independently on each router, so without additional configuration (e.g., PBR or tunnel interface binding), traffic can easily become asymmetric.

How to eliminate wrong answers

Option A is wrong because BGP with equal AS path length does not enforce symmetric traffic flow; BGP selects the best path based on multiple attributes, and the return path is determined independently by the remote router, so asymmetry can still occur. Option C is wrong because deploying multiple VPN tunnels with different priorities (e.g., using route metrics) only controls which tunnel is preferred for outbound traffic, but the return path is decided by the remote side, which may not match the priority settings. Option D is wrong because static routes pointing to the VPN tunnel on both sides do not guarantee symmetry; if the on-premises router has multiple equal-cost paths or a different routing table, return traffic could take a different tunnel, breaking symmetry.

Practice this question →

173

MCQhard

A network engineer has configured a Dedicated Interconnect with a VLAN attachment and Cloud Router. BGP sessions are up and routes are exchanged. However, traffic from a specific on-premises subnet is not reaching a VPC instance. The route table shows a custom static route with priority 1000 for that subnet pointing to a VPN tunnel, and a BGP learned route with priority 100 for the same subnet via Interconnect. What is the most likely reason for the traffic not using the Interconnect route?

A.The BGP route's next hop is not reachable due to a missing firewall rule on the on-premises side

B.Route propagation is disabled on the Cloud Router

C.VPC firewall rules are blocking traffic on the Interconnect VLAN attachment

D.The BGP route has a lower MED than the static route

AnswerA

If the on-premises next hop is unreachable, Cloud Router cannot forward traffic, causing blackhole.

Why this answer

The BGP route with priority 100 is preferred over the static route with priority 1000. However, if the BGP route's next hop is not reachable (e.g., due to a missing firewall rule on the on-premises side blocking the necessary ICMP or BGP session traffic), the route will be considered invalid and not installed in the routing table. This causes traffic to fall back to the less preferred static route via the VPN tunnel, explaining why the Interconnect path is not used.

Exam trap

Google Cloud often tests the misconception that route priority alone determines path selection, but the trap here is that a BGP route with a lower priority can still be invalid if its next hop is unreachable, causing the router to use a higher-priority static route instead.

How to eliminate wrong answers

Option B is wrong because route propagation is enabled by default on Cloud Router when BGP sessions are up and routes are exchanged, as stated in the scenario. Option C is wrong because VPC firewall rules apply to instances, not to the Interconnect VLAN attachment itself; the attachment operates at Layer 2/3 and is not subject to VPC firewall rules. Option D is wrong because MED is a BGP attribute used for path selection among multiple paths from the same AS, but a static route (priority 1000) is always less preferred than a BGP route (priority 100) regardless of MED values.

Practice this question →

174

MCQmedium

A company wants to allow on-premises DNS servers to resolve Google Cloud private VM names. They need to configure a Google-managed forwarding server IP. Which Cloud DNS feature should they use?

A.Outbound DNS forwarding

B.Cloud Router with BGP

C.Inbound DNS policy

D.Private DNS zone with peering

AnswerC

Inbound policy provides a Google-managed forwarding IP for on-premises to query.

Why this answer

Inbound DNS policy creates a forwarding zone and provides a Google-managed inbound server IP that on-premises servers can use to resolve GCP private DNS names.

Practice this question →

175

Multi-Selecthard

A Cloud VPN with dynamic routing (BGP) is established between an on-premises network and Google Cloud. The on-premises BGP router is advertising a default route (0.0.0.0/0). The Cloud Router in Google Cloud is receiving this route, but network traffic from Google Cloud VMs to the internet is not being routed through the VPN. Which THREE troubleshooting steps should you take? (Choose three.)

Select 3 answers

A.Verify that the VPC's dynamic routing mode is set to 'global' if using regional routing.

B.Check VPC firewall rules to ensure they allow egress traffic from VMs.

C.Check the route priority (preference) of the default route learned via BGP compared to the default internet gateway route.

D.Verify that the Cloud Router is configured to advertise the default route to the VPC.

E.Ensure that the on-premises router is sending the default route with a higher local preference.

AnswersA, C, D

Global routing ensures the default route is propagated to all regions.

Why this answer

The VPC's dynamic routing mode determines the scope of route propagation. If the VPC uses regional dynamic routing, Cloud Router only propagates routes within the region where the VPN tunnel is attached. A global dynamic routing mode is required for the BGP-learned default route to be available across all regions, ensuring VMs in any region can use the VPN for internet egress.

Exam trap

The trap here is that candidates often assume firewall rules are the issue when traffic fails to route, but the core problem is route selection and propagation—specifically, the default internet gateway route competing with the BGP-learned route, and the Cloud Router's advertisement settings.

Practice this question →

176

Multi-Selecthard

A company currently uses Cloud VPN with dynamic routing to connect to Google Cloud. They want to migrate to Dedicated Interconnect without downtime. Which THREE steps should they take to achieve a seamless migration? (Choose three.)

Select 3 answers

A.Order and provision the Dedicated Interconnect

B.Configure BGP on the on-premises router for the Interconnect and start advertising routes

C.Create a new VLAN attachment and attach it to the existing Cloud Router to peer with both VPN and Interconnect

D.Decrease the BGP route priority (MED) on the VPN advertisements to make VPN less preferred

E.Update on-premises firewall rules to allow traffic over the new Interconnect

AnswersA, B, C

First, you need to have the physical connection ready.

Why this answer

Ordering and provisioning the Dedicated Interconnect is the foundational step to establish the physical connection between the on-premises network and Google Cloud. Without this, no migration can occur. This involves working with a Google Cloud partner to ensure the cross-connect is completed and the VLAN attachments are created.

Exam trap

Google Cloud often tests the misconception that firewall rules must be updated when migrating connectivity types, but in reality, the migration is driven by BGP route preference adjustments, not firewall changes.

Practice this question →

177

MCQhard

An organization uses HA VPN with dynamic routing and active-active BGP sessions. One tunnel fails, but traffic continues to flow through the other tunnel. However, they notice increased latency. What is the most likely explanation?

A.BGP multipath is enabled, causing all traffic to be sent through the remaining tunnel.

B.The remaining tunnel is using a different encryption algorithm.

C.The BGP timers are misconfigured.

D.The failed tunnel's routes are still in the routing table.

AnswerA

With multipath, traffic is normally split; after failure, all traffic goes through one tunnel, potentially causing congestion.

Why this answer

When BGP multipath is enabled on an HA VPN with active-active BGP sessions, the router can load-balance traffic across multiple tunnels. If one tunnel fails, all traffic is redirected through the remaining tunnel, which can cause increased latency due to congestion or suboptimal path selection. The correct answer is A because this behavior directly explains the latency increase after a tunnel failure.

Exam trap

Google Cloud often tests the misconception that increased latency after a tunnel failure is due to routing table issues or encryption changes, when in fact it is the result of BGP multipath concentrating all traffic onto a single tunnel, causing congestion.

How to eliminate wrong answers

Option B is wrong because encryption algorithms (e.g., AES-128 vs AES-256) affect security and CPU overhead, not latency in a way that would suddenly increase after a tunnel failure; the remaining tunnel would have been using the same algorithm before the failure. Option C is wrong because misconfigured BGP timers (e.g., keepalive or hold timers) would cause session instability or flapping, not a gradual latency increase after a single tunnel failure. Option D is wrong because if the failed tunnel's routes were still in the routing table, traffic would attempt to use the failed tunnel and result in packet loss or blackholing, not increased latency; BGP withdraws routes from the failed tunnel upon session loss.

Practice this question →

178

MCQhard

A network engineer is troubleshooting a failing HA VPN tunnel. They need to view VPN gateway logs to identify the issue. Which Google Cloud service should they use to access the logs?

A.Cloud Audit Logs

B.Cloud Debugger

C.Cloud Monitoring

D.Cloud Logging

AnswerD

Cloud Logging stores and allows querying of VPN gateway logs.

Why this answer

Cloud Logging captures logs from Cloud VPN gateways, including tunnel events, IKE negotiations, and error messages.

Practice this question →

179

MCQmedium

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They have two VLAN attachments (vlan-100 and vlan-200) connected to two separate Cloud Routers in the same region. Each Cloud Router has a BGP session with the on-premises router. The on-premises router advertises the same prefixes (10.0.0.0/8) over both sessions. In Google Cloud, they have workloads in two different VPCs: VPC-A and VPC-B. They want traffic to VPC-A to use vlan-100, and traffic to VPC-B to use vlan-200. Cloud Router 1 is attached to VPC-A, Cloud Router 2 is attached to VPC-B. Currently, traffic from on-premises to VPC-A sometimes goes through vlan-200, causing asymmetric routing. What configuration change should they make to ensure traffic is symmetric?

A.Set a higher MED on the on-premises router for routes advertised to vlan-200, making vlan-100 preferred for all traffic.

B.Configure static routes on the on-premises router to force traffic to VPC-A via vlan-100 and to VPC-B via vlan-200.

C.Create two separate VPCs and assign each VLAN attachment to a different VPC.

D.Use BGP community tags on the on-premises router to label routes for VPC-A and VPC-B, and configure route priority on Cloud Router to match these communities.

AnswerD

BGP communities allow granular route manipulation, ensuring traffic for each VPC uses the designated attachment.

Why this answer

BGP community tags allow the on-premises router to tag routes for VPC-A and VPC-B differently. Cloud Router can then use these community tags to influence route priority (e.g., via local preference or MED matching), ensuring that traffic to VPC-A is always routed through vlan-100 and traffic to VPC-B through vlan-200, solving the asymmetric routing issue without relying on static routes or MED manipulation that would affect all traffic.

Exam trap

The trap here is that candidates often assume MED or static routes can solve asymmetric routing, but they overlook that MED affects all routes from a neighbor and static routes on-premises cannot control Google Cloud's return path selection, whereas BGP communities provide the necessary granularity to influence path selection per prefix in both directions.

How to eliminate wrong answers

Option A is wrong because setting a higher MED on the on-premises router for routes advertised to vlan-200 would make vlan-100 preferred for all prefixes, not just those destined for VPC-A; this would force all traffic through vlan-100, breaking the requirement for VPC-B traffic to use vlan-200. Option B is wrong because static routes on the on-premises router cannot override BGP-learned routes on the Google Cloud side; the asymmetric routing occurs because Google Cloud's Cloud Routers may still prefer the alternate path due to equal-cost multi-path (ECMP) or BGP best-path selection, and static routes on-premises do not control return path selection in Google Cloud. Option C is wrong because the two VLAN attachments are already connected to separate VPCs (VPC-A and VPC-B) via their respective Cloud Routers; creating two separate VPCs again would not change the routing behavior—the issue is that both Cloud Routers receive the same prefix (10.0.0.0/8) and Google Cloud may load-balance or choose the wrong path, not a VPC attachment problem.

Practice this question →

180

MCQhard

A large enterprise has two on-premises data centers (DC1 and DC2) connected to Google Cloud via two separate VPN tunnels to the same VPC. Each tunnel terminates on a different Cloud VPN gateway (gateway1 in us-east1, gateway2 in us-west1). The on-premises routers advertise the same CIDR 172.16.0.0/12 from both DCs. Cloud Router is configured with BGP and uses default route priority. You notice that after a failover event where one tunnel goes down, traffic continues to flow, but there is a significant increase in latency for traffic coming from GCP to on-premises. You verify that both tunnels have re-established. What is the most likely cause of the increased latency?

A.The on-premises routers are using site-to-site VPN between themselves causing a routing loop

B.The on-premises routers do not use AS path prepending to prefer the local DC's path for the prefix

C.The Cloud VPN tunnels are using different preshared keys

D.Bidirectional Forwarding Detection (BFD) is not enabled on the Cloud VPN tunnels

AnswerB

Without AS path prepending, GCP may choose a suboptimal path (e.g., sending DC1 traffic via DC2) if the routes have equal AS path length, causing increased latency.

Why this answer

When both on-premises routers advertise the same CIDR (172.16.0.0/12) to Google Cloud via BGP, Cloud Router selects the path with the shorter AS path length by default. Without AS path prepending on the backup DC's router, both routes have equal AS path length, causing Cloud Router to load-balance or pick a suboptimal path after failover. After the tunnel re-establishes, traffic from GCP may still be routed to the remote DC (e.g., DC2) instead of the local DC (DC1), resulting in higher latency due to cross-country or inter-DC transit.

Exam trap

Google Cloud often tests the misconception that increased latency after failover is due to a routing loop or BFD misconfiguration, when the real issue is the lack of AS path prepending to influence BGP path selection for the same prefix advertised from multiple locations.

How to eliminate wrong answers

Option A is wrong because site-to-site VPN between on-premises routers would not cause a routing loop in this scenario; the increased latency is due to suboptimal path selection, not a loop. Option C is wrong because different preshared keys would prevent the VPN tunnels from establishing at all, not cause increased latency after re-establishment. Option D is wrong because BFD is used for fast failure detection, not for influencing path selection or latency after tunnels are up; its absence would delay failover detection, not increase latency post-failover.

Practice this question →

181

Multi-Selectmedium

A company is using Cloud Interconnect with multiple VLAN attachments. They want to implement traffic shaping to prioritize real-time traffic over bulk transfers. Which THREE actions should they take?

Select 3 answers

A.Set up Cloud Router with BGP QoS policies to match DSCP values

B.Enable Cloud NAT to handle traffic shaping

C.Create VPC firewall rules to classify traffic based on source/destination

D.Configure DSCP markings on the on-premises routers for different traffic types

E.Use VPC flow logs to identify heavy traffic flows

AnswersA, C, D

Cloud Router can apply QoS based on DSCP.

Why this answer

Cloud Router with BGP QoS policies can match DSCP values to prioritize traffic. By configuring BGP QoS policies, you can map specific DSCP values to different traffic classes, allowing Cloud Interconnect to apply traffic shaping that prioritizes real-time traffic (e.g., VoIP) over bulk transfers. This leverages BGP community attributes to signal QoS requirements across the hybrid connection.

Exam trap

The trap here is that candidates confuse monitoring tools (VPC flow logs) or unrelated services (Cloud NAT) with traffic shaping mechanisms, overlooking that DSCP marking and BGP QoS policies are the correct approach for prioritizing traffic on Cloud Interconnect.

Practice this question →

182

MCQeasy

A company needs private connectivity between its on-premises data center and Google Cloud with consistent low latency and high throughput. The on-premises location is close to a Google Cloud point of presence that supports Dedicated Interconnect. The company expects to use more than 10 Gbps of bandwidth in the near future. Which connectivity solution should they choose?

A.Dedicated Interconnect

B.Partner Interconnect

C.HA VPN with dynamic routing

D.Cloud VPN with static routing

AnswerA

Dedicated Interconnect provides a direct, private connection with low latency and high bandwidth (10/100 Gbps) suitable for growing needs.

Why this answer

Dedicated Interconnect provides a direct, private physical connection between the on-premises data center and Google Cloud, offering consistent low latency and high throughput. Since the on-premises location is near a Google Cloud point of presence that supports Dedicated Interconnect and the bandwidth requirement exceeds 10 Gbps (Dedicated Interconnect supports up to 10 Gbps per circuit, with multiple circuits for higher aggregate bandwidth), this is the optimal solution.

Exam trap

Google Cloud often tests the misconception that Partner Interconnect is equivalent to Dedicated Interconnect for high-bandwidth needs, but the key trap is that Partner Interconnect introduces a third-party provider's network, which cannot guarantee the same consistent low latency and throughput as a direct physical connection.

How to eliminate wrong answers

Option B is wrong because Partner Interconnect relies on a third-party service provider's network, which introduces additional latency and potential throughput variability, and typically supports lower bandwidths (up to 10 Gbps per VLAN attachment) compared to Dedicated Interconnect's direct physical links. Option C is wrong because HA VPN with dynamic routing uses the public internet or a third-party network, cannot guarantee consistent low latency or high throughput, and is limited to bandwidths far below 10 Gbps (typically up to 3 Gbps per tunnel). Option D is wrong because Cloud VPN with static routing also uses the public internet, lacks the performance guarantees needed for >10 Gbps, and static routing does not provide the redundancy or dynamic failover required for enterprise-grade hybrid connectivity.

Practice this question →

183

MCQmedium

A company is using Partner Interconnect with a service provider that offers Layer 3 connectivity. The service provider manages the BGP sessions. The engineer needs to create a VLAN attachment on the Google side. Which attachment type should they choose?

A.PARTNER

B.MANAGED

C.DEDICATED

D.PARTNER_PROVIDER

AnswerD

PARTNER_PROVIDER attachment type is for Layer 3 connectivity where the service provider manages BGP.

Why this answer

For Partner Interconnect, when the service provider manages Layer 3 (BGP), the VLAN attachment type must be PARTNER_PROVIDER. The PARTNER type is for Layer 2 connectivity where the customer manages BGP.

Practice this question →

184

MCQmedium

An engineer is configuring Dedicated Interconnect between an on-premises data center and Google Cloud. Cloud Router is set up with BGP sessions. The BGP session remains in Idle state. Which of the following is the most likely cause?

A.The Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface.

B.The on-premises router is not advertising the Google Cloud VPC subnet routes.

C.The interconnect is not configured with redundant links.

D.The VLAN attachment is not in the same region as the Cloud Router.

AnswerA

IP mismatch is a common cause of BGP Idle state.

Why this answer

The BGP session remains in Idle state because the Cloud Router's BGP IP address is not in the same subnet as the on-premises router's interface. For BGP peering over Dedicated Interconnect, the two routers must be directly connected at Layer 3, meaning their BGP peer IP addresses must belong to the same /30 or /31 subnet. If they are in different subnets, the TCP connection for BGP cannot be established, keeping the session in Idle state.

Exam trap

The trap here is that candidates often confuse BGP session states with route advertisement issues, assuming missing routes cause Idle state, when in fact Idle state is a Layer 3 connectivity problem, not a routing policy problem.

How to eliminate wrong answers

Option B is wrong because the on-premises router not advertising the Google Cloud VPC subnet routes would not cause the BGP session to remain in Idle state; it would instead cause routes to be missing from the routing table after the session is established. Option C is wrong because redundant links are not required for a single BGP session to transition out of Idle state; redundancy affects high availability, not the initial BGP peering process. Option D is wrong because the VLAN attachment must be in the same region as the Cloud Router for the interconnect to function, but if it were not, the BGP session would not even be configured or would fail at a lower layer, not specifically remain in Idle state.

Practice this question →

185

Multi-Selecthard

A company has a Hybrid Connectivity setup using Cloud VPN with BGP. They want to migrate to Dedicated Interconnect for better performance. During the migration, they need to avoid downtime. Which THREE steps should they take?

Select 3 answers

A.Set a lower local preference on the Interconnect BGP session

B.Remove the VPN tunnels immediately after Interconnect is up

C.Provision the Dedicated Interconnect and VLAN attachments

D.Configure BGP on the Interconnect with a higher local preference than the VPN

E.Gradually withdraw VPN routes after verifying Interconnect traffic

AnswersC, D, E

Must have the Interconnect physical path ready.

Why this answer

Provisioning the Dedicated Interconnect and VLAN attachments is the foundational step to establish the new high-performance connection. Without this, there is no physical or logical path to migrate traffic onto. This must be done before any BGP configuration or route manipulation can occur.

Exam trap

Google Cloud often tests the misconception that you should immediately remove the old connection (VPN tunnels) once the new one (Interconnect) is up, but the correct approach is to gracefully shift traffic using BGP attributes and then decommission the old path only after verification.

Practice this question →

186

MCQmedium

A company is using Partner Interconnect to connect their on-premises network to Google Cloud. They need to choose between Layer 2 and Layer 3 connectivity options offered by the service provider. Which statement correctly describes the difference between Layer 2 and Layer 3 connectivity in Partner Interconnect?

A.Layer 2 connectivity requires the customer to configure BGP with Google Cloud, while Layer 3 does not require any BGP on the customer side.

B.Layer 2 connectivity is only available for Dedicated Interconnect, not Partner Interconnect.

C.Both Layer 2 and Layer 3 require the customer to manage VLAN attachments inside GCP.

D.Layer 3 connectivity requires the customer to have a BGP session with the partner's router, while Layer 2 allows direct BGP with Google Cloud.

AnswerD

This correctly describes the difference: Layer 2 is direct BGP with Google, Layer 3 uses the partner as a routing hop.

Why this answer

With Layer 2, the partner provides a transparent VLAN; with Layer 3, the partner handles the IP routing, requiring a BGP session from the customer's on-prem router to the partner's router.

Practice this question →

187

MCQmedium

An organization is using Cloud VPN with dynamic routing (BGP) to connect their on-premises network to Google Cloud. They want to prioritize traffic from on-premises to GCP over one VPN tunnel when multiple tunnels are available. Which BGP attribute should they configure on their on-premises router?

A.MED (Multi-Exit Discriminator)

B.AS path prepending

C.Origin attribute

D.Local Preference (LP)

AnswerD

Local Preference is used to influence outbound traffic within an AS. Setting a higher value on the preferred tunnel directs traffic from on-premises to GCP through that tunnel.

Why this answer

Local Preference (LP) is a BGP attribute that influences outbound traffic from an AS. When configuring multiple VPN tunnels, setting a higher Local Preference on the preferred tunnel will cause the on-premises router to choose that tunnel for traffic destined to GCP. AS path prepending, on the other hand, is used to influence inbound traffic by making a route less preferred; it does not affect outbound path selection from the on-premises network.

Exam trap

A common mistake is confusing BGP attributes that affect inbound vs. outbound traffic. AS path prepending influences inbound traffic to the router, while Local Preference influences outbound traffic. For traffic from on-premises to GCP, use Local Preference.

Practice this question →

188

Multi-Selectmedium

Which TWO of the following are required steps to set up a Dedicated Interconnect?

Select 2 answers

A.Create an interconnect (physical connection) in the colocation facility

B.Establish a VPN tunnel as a backup

C.Create a Cloud Router and VLAN attachment

D.Deploy a Google-provided router in the colocation facility

E.Configure MD5 authentication on the BGP session

AnswersA, C

The physical cross-connect is necessary.

Why this answer

Creating an interconnect (physical connection) in the colocation facility is a required step because Dedicated Interconnect requires a direct, physical cross-connect between your on-premises router and a Google Cloud edge router at a colocation facility. This physical link is the foundation of the dedicated, high-bandwidth connection, and without it, no Layer 2 or Layer 3 connectivity can be established.

Exam trap

Google Cloud often tests the misconception that you must deploy a Google-provided router in the colocation facility, but in reality, you use your own router and Google provides only the edge router in their network.

Practice this question →

189

MCQhard

A Dedicated Interconnect VLAN attachment is in ACTIVE state. The Cloud Router has learned routes from on-premises, and the on-premises router has learned routes from GCP. However, traffic from on-premises to a GCP VM fails. What should the engineer check first?

A.Check firewall rules on the GCP VPC for ingress from the on-premises range.

B.Confirm that the Cloud Router is advertising the on-premises subnets back to the VPC.

C.Verify that the VPC subnet routes exist in the routing table.

D.Both A and C.

AnswerD

Both firewall rules and Cloud Router advertisement must be verified.

Why this answer

Both firewall rules and VPC subnet routes must be in place for traffic to reach a GCP VM. Even if the VLAN attachment is ACTIVE and routes are exchanged, the VPC firewall must permit ingress from the on-premises range, and the VPC subnet routes must exist in the routing table for the VM's subnet. Without both, traffic will be dropped or not forwarded.

Exam trap

Google Cloud often tests the misconception that route exchange alone guarantees connectivity, but in GCP, both firewall rules and subnet routes are mandatory for traffic to reach a VM, even when the interconnect is ACTIVE and BGP sessions are established.

How to eliminate wrong answers

Option A is wrong because checking only firewall rules is insufficient; the VPC subnet routes must also exist for the traffic to be routed to the VM. Option B is wrong because the Cloud Router advertising on-premises subnets back to the VPC is not required for traffic from on-premises to GCP; the on-premises router already learned GCP routes, and the Cloud Router's job is to advertise GCP routes to on-premises, not the reverse. Option C is wrong because verifying only subnet routes ignores the firewall rules that control ingress traffic; both are necessary.

Practice this question →

190

Multi-Selectmedium

Which TWO statements about HA VPN are correct?

Select 2 answers

A.Both VPN gateways must be in the same region.

B.It uses IKEv1 by default.

C.It supports both active-active and active-passive modes.

D.It supports static routing as well as dynamic routing.

E.It requires two Cloud VPN gateways.

AnswersC, E

HA VPN can be configured in either mode depending on redundancy needs.

Why this answer

HA VPN supports both active-active and active-passive modes. In active-active mode, both tunnels forward traffic simultaneously, while in active-passive mode, one tunnel is used as a standby. This flexibility allows HA VPN to meet different high-availability and load-balancing requirements.

Exam trap

Google Cloud often tests the misconception that HA VPN requires both gateways in the same region or that it supports static routing, but the correct understanding is that HA VPN uses dynamic routing (BGP) and allows gateways in different regions.

Practice this question →

191

Multi-Selectmedium

Which THREE factors can affect the throughput of a Cloud VPN tunnel? (Choose three.)

Select 3 answers

A.VM instance types

B.Number of tunnels

C.Tunnel type (route-based vs policy-based)

D.Encryption algorithm

E.On-premises router CPU capacity

AnswersC, D, E

Different tunnel types have different overheads.

Why this answer

Tunnel type (route-based vs policy-based) affects throughput because route-based tunnels (e.g., using BGP or static routes) can leverage ECMP and do not require per-flow policy lookups, reducing CPU overhead. Policy-based tunnels require the VPN gateway to evaluate each packet against a security policy, which adds latency and can limit throughput, especially under high traffic loads.

Exam trap

Google Cloud often tests the misconception that VM instance types or the number of tunnels directly control VPN throughput, when in reality the tunnel type, encryption algorithm, and on-premises router CPU are the primary factors that limit or enhance throughput.

Practice this question →

192

MCQeasy

A company requires a dedicated connection from their on-premises data center to Google Cloud with a guaranteed SLA of 99.99% and bandwidth starting at 10 Gbps. Which connectivity option meets these requirements?

A.Direct Peering

B.Cloud VPN

C.Dedicated Interconnect

D.Partner Interconnect

AnswerC

Offers 10 Gbps or higher and 99.99% SLA.

Why this answer

Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google Cloud, supporting bandwidths of 10 Gbps or 100 Gbps per circuit. It offers a 99.99% or 99.999% SLA depending on the configuration (e.g., dual connections with diverse paths), meeting the guaranteed SLA and bandwidth requirements specified in the question.

Exam trap

Google Cloud often tests the misconception that Partner Interconnect can match Dedicated Interconnect's SLA and bandwidth guarantees, but Partner Interconnect's SLA is typically limited to the partner's network and does not meet the 99.99% requirement without additional redundancy from the partner.

How to eliminate wrong answers

Option A is wrong because Direct Peering is a public peering arrangement that does not provide a dedicated connection, offers no SLA, and bandwidth is not guaranteed at 10 Gbps. Option B is wrong because Cloud VPN uses the public internet with IPsec tunnels, providing no SLA and typically supporting lower bandwidth (up to 3 Gbps per tunnel with HA VPN). Option D is wrong because Partner Interconnect relies on a third-party service provider and does not guarantee a 99.99% SLA or 10 Gbps bandwidth directly from Google; the SLA and bandwidth depend on the partner's infrastructure.

Practice this question →

193

MCQeasy

Your organization has a site-to-site Cloud VPN connection between an on-premises network with CIDR 10.0.0.0/8 and a VPC in us-central1 with subnet 192.168.1.0/24. The VPN tunnel is established, but you cannot reach a Compute Engine instance with internal IP 192.168.1.10 from a server on-premises with IP 10.0.0.50. Cloud VPN logs show no errors. On-premises firewall rules allow all outbound traffic. What is the most likely cause of the problem?

A.A firewall rule on the VPC blocking inbound traffic from 10.0.0.0/8

B.Missing a static route on the on-premises router for 192.168.1.0/24 pointing to the VPN gateway

C.The Compute Engine instance's OS firewall blocking ICMP

D.Incorrect IAM permissions on the Cloud VPN gateway

AnswerB

Without a proper route on-premises, traffic to GCP may not be forwarded to the VPN peer.

Why this answer

The VPN tunnel is established and Cloud VPN logs show no errors, indicating the cloud side is configured correctly. However, the on-premises server at 10.0.0.50 cannot reach 192.168.1.10 because the on-premises router lacks a static route for the VPC subnet 192.168.1.0/24 pointing to the VPN gateway. Without this route, the on-premises router does not know to send traffic destined for 192.168.1.0/24 through the VPN tunnel, so packets are dropped or sent to the default gateway instead.

Exam trap

Google Cloud often tests the misconception that a successful VPN tunnel establishment implies full bidirectional connectivity, when in fact routing must be explicitly configured on both sides for traffic to flow.

How to eliminate wrong answers

Option A is wrong because VPC firewall rules are stateful and by default allow inbound traffic from any source unless explicitly denied; the question states no errors in Cloud VPN logs, and a VPC firewall rule blocking 10.0.0.0/8 would generate logged denies, not a silent failure. Option C is wrong because the problem is about reachability at the network layer (IP routing), not the application layer; even if the instance's OS firewall blocks ICMP, the traffic would still reach the instance (the OS would receive it and drop it), but the symptom here is no connectivity at all, indicating a routing issue. Option D is wrong because IAM permissions control management of the VPN gateway (e.g., creating/modifying tunnels), not the data-plane forwarding of traffic through an established tunnel; the tunnel is up and logs show no errors, so IAM is irrelevant.

Practice this question →

194

MCQeasy

A small company is moving their on-premises application to Google Cloud. They have a single on-premises office with a small router that supports IPsec VPN. They need a simple and low-cost connectivity solution that provides encryption and a consistent experience. They anticipate low bandwidth needs (under 100 Mbps). They also want the ability to use BGP for dynamic routing to avoid manual route updates. Which Google Cloud service should they use?

A.Partner Interconnect

B.Cloud HA VPN with dynamic routing (BGP)

C.Cloud Classic VPN with static routes

D.Direct Peering

AnswerB

HA VPN supports dynamic routing, provides encryption, and is cost-effective for low bandwidth.

Why this answer

Cloud HA VPN with dynamic routing (BGP) is the correct choice because it provides an encrypted IPsec tunnel, supports BGP for automatic route exchange, and is a low-cost, simple solution for sub-100 Mbps bandwidth needs. It meets the requirement for a consistent experience without the complexity or cost of dedicated interconnect services.

Exam trap

The trap here is that candidates often confuse Cloud Classic VPN with static routes as sufficient for dynamic routing, but Cisco tests the distinction that static routes require manual updates while BGP provides automatic route exchange, making Cloud HA VPN the only correct option for dynamic routing with encryption at low cost.

How to eliminate wrong answers

Option A is wrong because Partner Interconnect is a dedicated, high-bandwidth connection (typically >1 Gbps) that requires a service provider and incurs higher costs, making it overkill for low bandwidth under 100 Mbps. Option C is wrong because Cloud Classic VPN with static routes does not support BGP for dynamic routing, requiring manual route updates which contradicts the requirement for dynamic routing. Option D is wrong because Direct Peering is a non-encrypted, direct connection to Google's network that does not provide IPsec encryption and is intended for high-volume traffic, not simple low-cost connectivity with encryption.

Practice this question →

195

MCQeasy

An organization wants to connect their on-premises network to Google Cloud using a Dedicated Interconnect. They have ordered a circuit from a network service provider and need to determine the correct co-location facility to connect to. Which factor is most critical when selecting a co-location facility?

A.The facility must offer Layer 2 connectivity to the Google Cloud VPC.

B.The facility must be a Google Cloud partner facility with access to a Google PoP in the same metro as the on-premises data center.

C.The facility must support 100 Gbps ports to maximize throughput.

D.The facility must be in a different continent to ensure geographic redundancy.

AnswerB

This ensures low latency and meets the requirements for Dedicated Interconnect.

Why this answer

The co-location facility must be a Google Cloud partner facility that provides access to a Google Point of Presence (PoP) in the same metro area as the organization's on-premises data center to minimize latency and meet SLA requirements.

Practice this question →

196

MCQeasy

A network engineer is setting up Dedicated Interconnect and sees the output above. What does the 'encryption: IPSEC' field indicate about this VLAN attachment?

A.Traffic over this VLAN attachment is encrypted using IPsec

B.The attachment is using Cloud VPN as the underlying transport

C.The attachment requires a Cloud VPN tunnel in addition to the Interconnect

D.The attachment is using MACsec encryption at layer 2

AnswerA

IPsec encryption is enabled on this attachment.

Why this answer

The 'encryption: IPSEC' field in the VLAN attachment output for Dedicated Interconnect indicates that traffic traversing this attachment is encrypted using IPsec. This is a feature of Google Cloud's Dedicated Interconnect that allows you to enable IPsec encryption on the VLAN attachment itself, providing confidentiality and integrity for data in transit without requiring a separate Cloud VPN tunnel.

Exam trap

Google Cloud often tests the misconception that IPsec encryption on a VLAN attachment requires a separate Cloud VPN tunnel, but in reality, the encryption is a built-in feature of the attachment itself.

How to eliminate wrong answers

Option B is wrong because Cloud VPN is not the underlying transport; Dedicated Interconnect uses a direct physical connection between your on-premises network and Google's network, and IPsec encryption is applied on top of that direct link, not via a VPN tunnel. Option C is wrong because the IPsec encryption is configured directly on the VLAN attachment, so no additional Cloud VPN tunnel is required; the attachment itself handles the encryption. Option D is wrong because MACsec operates at Layer 2 (Ethernet) and uses different encryption mechanisms (IEEE 802.1AE), while the output explicitly states 'IPSEC', which is a Layer 3 protocol (RFC 4301).

Practice this question →

197

MCQmedium

A company is setting up HA VPN between GCP and an on-premises network. They need to configure two VPN tunnels for high availability. Which of the following is required for the HA VPN gateway?

A.A single external IP address shared by both interfaces.

B.A Cloud Router with BGP enabled on both tunnels.

C.A dedicated interconnect circuit.

D.Two external IP addresses, one for each interface.

AnswerD

HA VPN uses two interfaces with distinct external IPs.

Why this answer

An HA VPN gateway has two interfaces, each with its own external IP address. This allows two tunnels to be established for redundancy.

Practice this question →

198

Multi-Selecteasy

Which TWO situations are most appropriate for using Partner Interconnect instead of Dedicated Interconnect?

Select 2 answers

A.When you need IPSec encryption

B.When 99.99% SLA is required

C.When data center space is limited and you cannot host a Google edge router

D.When bandwidth requirements exceed 10 Gbps per connection

E.When you want to leverage existing service provider connectivity

AnswersC, E

Correct. If you cannot host a Google edge router because of limited data center space, Partner Interconnect allows you to connect through a service provider's facility, avoiding the need for direct colocation.

Why this answer

Partner Interconnect is ideal when you lack direct colocation space (Option C) because it uses a service provider's facility to connect to Google. It is also appropriate when you want to leverage an existing service provider connection (Option E), as the partner already has a presence in a Google Cloud edge location. In contrast, Dedicated Interconnect requires direct colocation and provides higher bandwidth and SLA, making it unsuitable for these scenarios.

Practice this question →

199

MCQhard

A network engineer configured a Cloud Router with the BGP configuration shown. The on-premises router (AS 64512) is peering with the Cloud Router (AS 65001) over a Dedicated Interconnect VLAN attachment. The engineer notices that traffic from on-premises to Google Cloud is not being routed via this interconnect as expected. What is the most likely cause?

A.The route-map SET-MED sets the MED attribute incorrectly

B.The ebgp-multihop 2 command is not supported on Cloud Router

C.The update-source loopback0 command is invalid for Cloud Router BGP sessions

D.The local-preference is set in the outbound direction, which is not allowed

AnswerC

Cloud Router requires the BGP session to use the link-local IP address, not a loopback.

Why this answer

Cloud Router does not support the `update-source loopback0` command. BGP sessions on Cloud Router must use the primary IP address of the interface that is directly connected to the VLAN attachment; loopback interfaces are not supported for BGP peering. This command would cause the Cloud Router to attempt to source BGP packets from a loopback address that is not reachable by the on-premises router, breaking the BGP session.

Exam trap

Google Cloud often tests the misconception that Cloud Router supports the same BGP commands as a physical Cisco router, leading candidates to overlook the fact that Cloud Router is a managed service with a restricted feature set, particularly regarding interface sourcing and multihop capabilities.

How to eliminate wrong answers

Option A is wrong because the MED attribute is typically used to influence inbound traffic from a peer, and while a route-map SET-MED could affect path selection, it would not prevent traffic from being routed via the interconnect; the issue is that traffic is not being routed at all, not that it is taking a suboptimal path. Option B is wrong because `ebgp-multihop` is not a command used on Cloud Router; Cloud Router does not support ebgp-multihop, but the absence of this command would not cause the described issue—the session would simply require direct connectivity. Option D is wrong because setting local-preference in the outbound direction is allowed and is a common practice to influence inbound traffic; however, local-preference is a well-known mandatory attribute that is sent to eBGP peers by default, and setting it outbound does not break routing.

Practice this question →

200

MCQmedium

Refer to the exhibit. An engineer has configured HA VPN with two tunnels (tunnel-a and tunnel-b) to an on-premises network. The BGP session for peer-b is in IDLE state. What is the most likely cause?

A.The Cloud Router is not in the same region as the VPN gateway.

B.The on-premises router is not advertising any routes.

C.The pre-shared key for tunnel-b is incorrect.

D.The on-premises router's BGP configuration for peer-b has a wrong IP address.

AnswerD

IP mismatch causes BGP IDLE state; tunnel status indicates VPN is up, so BGP configuration is likely the issue.

Why this answer

The BGP session for peer-b is in IDLE state, which typically indicates a TCP connection failure. Since tunnel-a is working, the Cloud Router and VPN gateway are correctly configured, and the issue is specific to peer-b. The most likely cause is that the on-premises router's BGP configuration for peer-b has the wrong IP address (e.g., the wrong BGP peer IP or the wrong Cloud Router interface IP), preventing the TCP handshake from completing.

Exam trap

Google Cloud often tests the distinction between BGP session states and tunnel/encryption failures; the trap here is that candidates assume any BGP issue is caused by route advertisement problems, when in fact the IDLE state points to a TCP connectivity issue, such as a wrong peer IP address.

How to eliminate wrong answers

Option A is wrong because the Cloud Router must be in the same region as the VPN gateway for HA VPN to function; if it were not, tunnel-a would also fail, but it is working. Option B is wrong because the BGP session being in IDLE state is a transport-layer issue (TCP connection not established), not a routing advertisement issue; even if no routes are advertised, the BGP session would reach Established state with no prefixes. Option C is wrong because an incorrect pre-shared key would cause IKE/IPsec authentication failure, not a BGP IDLE state; the BGP session would not even attempt to start if the tunnel is down.

Practice this question →

201

MCQeasy

A company wants to connect its on-premises data center to Google Cloud. They have a single VPN appliance on-premises and need high availability for the connection. Which architecture provides the most cost-effective high availability solution?

A.Deploy Cloud HA VPN with two interfaces, each with its own external IP address, and configure two tunnels to the on-premises VPN appliance.

B.Use a single Cloud Classic VPN tunnel with a static route.

C.Deploy two Cloud Classic VPN gateways in the same region, each with one tunnel to the on-premises VPN appliance.

D.Deploy Cloud HA VPN with one interface and one external IP address, and configure a single tunnel to the on-premises appliance.

AnswerA

HA VPN uses two external IPs and two tunnels, providing automatic failover and high availability.

Why this answer

Cloud HA VPN provides high availability by using two interfaces with two external IP addresses, and you can configure two tunnels to a single on-premises VPN appliance. This architecture is cost-effective because it uses a single Cloud VPN gateway (HA VPN) and does not require additional infrastructure. Option B is incorrect because a single Classic VPN tunnel does not provide high availability.

Option C is incorrect because deploying two Classic VPN gateways is more expensive and still requires multiple tunnels to the same on-premises appliance, but it does not leverage the built-in HA capabilities of HA VPN. Option D is incorrect because Cloud HA VPN requires at least two interfaces (with separate IPs) to provide high availability; a single interface would be a single point of failure.

Practice this question →

202

Multi-Selecteasy

Which TWO configurations provide high availability for Dedicated Interconnect? (Choose two.)

Select 2 answers

A.Two connections to different PoPs.

B.A single circuit with L2 redundancy.

C.Using Cloud NAT for failover.

D.A single connection from one provider.

E.Two connections to the same PoP.

AnswersA, E

Geographic redundancy for higher availability.

Why this answer

Connecting to two different Points of Presence (PoPs) provides geographic redundancy; if one PoP fails, traffic can be rerouted through the other. Option E is correct because two connections to the same PoP provide link-level redundancy; if one circuit fails, the other can continue carrying traffic, and BGP can be used to load-balance or failover between them.

Exam trap

Google Cloud often tests the misconception that a single circuit with L2 redundancy (like LACP) is sufficient for high availability, but for Dedicated Interconnect, true HA requires multiple physical circuits (either to the same PoP or different PoPs) with BGP-based failover.

Practice this question →

203

MCQhard

A company is designing an HA VPN to connect their on-premises data center to Google Cloud VPC. The on-premises router supports two independent interfaces with public IPs. They want to achieve 99.99% availability for the VPN connection, understanding that HA VPN uses two tunnels and two Cloud Router instances. Which configuration meets this goal?

A.Two tunnels: both tunnels from the same on-premises interface to two different Cloud Router instances

B.Two tunnels: each tunnel from a separate on-premises interface to the same Cloud Router instance

C.Four tunnels: two tunnels from each on-premises interface to the same Cloud Router instance

D.Four tunnels: one tunnel from each on-premises interface to each Cloud Router instance, totaling four BGP sessions

AnswerD

This provides full device and path redundancy suitable for 99.99% availability.

Why this answer

HA VPN requires at least two Cloud Router instances and two tunnels from each on-premises interface to each Cloud Router instance to achieve 99.99% availability. This configuration creates four BGP sessions, ensuring that if one on-premises interface, one Cloud Router, or one tunnel fails, traffic can still flow through the remaining paths. The design leverages both redundancy of interfaces and redundancy of Cloud Routers to meet the high availability SLA.

Exam trap

The trap here is that candidates often think two tunnels (one per interface) to the same Cloud Router is sufficient, but they overlook that the Cloud Router itself is a single point of failure, and HA VPN requires redundancy at both the on-premises and Cloud Router layers to achieve 99.99% availability.

How to eliminate wrong answers

Option A is wrong because using the same on-premises interface for both tunnels creates a single point of failure at the on-premises side; if that interface fails, both tunnels go down, violating the 99.99% availability goal. Option B is wrong because both tunnels terminate on the same Cloud Router instance, which is a single point of failure in the Google Cloud side; if that Cloud Router fails, all BGP sessions are lost. Option C is wrong because four tunnels from two interfaces to the same Cloud Router instance still leaves the Cloud Router as a single point of failure, and the BGP sessions are not fully redundant across Cloud Routers.

Practice this question →

204

MCQeasy

A network engineer is configuring Cloud Router for Dedicated Interconnect. The on-premises router is advertising a route to 10.1.0.0/16. The engineer wants to ensure that Google Cloud always prefers this route over other routes learned from different on-premises routers. Which BGP attribute should be set on the on-premises router?

A.NEXT_HOP

B.AS_PATH

C.LOCAL_PREF

D.MED

AnswerD

Lower MED makes the route more preferred for inbound traffic from on-premises.

Why this answer

MED (Multi-Exit Discriminator) is the correct BGP attribute to influence inbound traffic from Google Cloud to prefer a specific on-premises router when multiple paths exist. By setting a lower MED value on the on-premises router, the Cloud Router will select that route over others with higher MED values, ensuring Google Cloud always prefers this path for traffic destined to 10.1.0.0/16.

Exam trap

The trap here is that candidates often confuse LOCAL_PREF (used for outbound path selection within an AS) with MED (used for inbound path selection between ASes), leading them to incorrectly choose LOCAL_PREF when the question asks about influencing Google Cloud's route preference from on-premises routers.

How to eliminate wrong answers

Option A is wrong because NEXT_HOP is a mandatory BGP attribute that specifies the IP address of the next-hop router, not a metric for path selection; it cannot influence route preference. Option B is wrong because AS_PATH is used for loop prevention and path selection (shorter AS_PATH is preferred), but it is not the attribute to force preference for a specific on-premises router; modifying AS_PATH artificially is not the intended mechanism. Option C is wrong because LOCAL_PREF is a well-known discretionary attribute used to influence outbound traffic from an AS, not inbound traffic; it is set within the local AS and not exchanged between peers, so it cannot be set on the on-premises router to affect Google Cloud's path selection.

Practice this question →

205

MCQeasy

Which Google Cloud hybrid connectivity option can be configured without using BGP?

A.Partner Interconnect

B.Dedicated Interconnect

C.HA VPN

D.Classic VPN with static routes

AnswerD

Classic VPN supports static routes, eliminating the need for BGP.

Why this answer

Classic VPN can be configured with static routes and does not require BGP. Partner Interconnect and Dedicated Interconnect require BGP for routing. HA VPN also typically uses BGP for dynamic routing, making D the only option that can operate without BGP.

Practice this question →

206

MCQmedium

An enterprise is using a 10 Gbps Dedicated Interconnect between their on-premises data center and Google Cloud. They measure throughput and find it is only 5 Gbps even though there is no congestion. The on-premises router is configured with a single VLAN attachment. What is the most likely cause?

A.BGP is not configured, causing routing loop

B.The on-premises router does not support full line rate

C.MTU mismatch between on-premises and Google Cloud

D.QoS policy is limiting throughput on Google Cloud side

AnswerB

The on-premises router may be the bottleneck.

Why this answer

A single VLAN attachment on a 10 Gbps Dedicated Interconnect means the on-premises router must handle all traffic through one physical interface. If the router lacks the forwarding capacity to process packets at 10 Gbps line rate, throughput will be capped at its maximum switching or routing performance, which in this case is 5 Gbps. This is a common hardware limitation, not a configuration or congestion issue.

Exam trap

Google Cloud often tests the misconception that throughput issues are always caused by configuration errors (e.g., MTU, BGP, QoS) rather than hardware limitations, leading candidates to overlook the router's actual forwarding capacity.

How to eliminate wrong answers

Option A is wrong because BGP is required for Dedicated Interconnect to exchange routes; without BGP, the interconnect would not establish connectivity at all, not just limit throughput to 5 Gbps. Option C is wrong because an MTU mismatch would cause packet fragmentation or drops, not a consistent 50% throughput reduction, and would typically manifest as packet loss or connectivity issues rather than a steady 5 Gbps cap. Option D is wrong because Google Cloud does not apply QoS policies that throttle throughput on Dedicated Interconnect attachments; throughput is limited by the on-premises router's capacity or the interconnect's bandwidth, not by cloud-side QoS.

Practice this question →

207

MCQhard

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

A.It depends on the redundancy requirements; typically two per attachment for active-active.

B.Four: two per VLAN attachment.

C.Two: one per VLAN attachment.

D.One: one session per Cloud Router.

AnswerA

For HA, each VLAN attachment should have two BGP sessions from two different on-premises routers, totaling four sessions.

Why this answer

With a Dedicated Interconnect using two VLAN attachments in different edge availability domains (EADs), the recommended best practice for high availability is to establish two BGP sessions per VLAN attachment (one active and one redundant) on the same Cloud Router, resulting in four sessions total. However, the question asks 'how many BGP sessions should be established' and the correct answer acknowledges that it depends on the redundancy requirements; typically two per attachment for active-active, but if active-passive is acceptable, fewer sessions may suffice. This flexibility makes 'It depends' the most accurate choice.

Exam trap

The trap here is that candidates assume a fixed number of BGP sessions (e.g., two or four) without considering that the redundancy model (active-active vs. active-passive) dictates the session count, leading them to pick a definitive number rather than the flexible 'it depends' answer.

How to eliminate wrong answers

Option B is wrong because stating 'Four: two per VLAN attachment' is too rigid; while four sessions are common for active-active redundancy, the requirement may vary based on design choices (e.g., active-passive could use two sessions total). Option C is wrong because 'Two: one per VLAN attachment' assumes a single BGP session per attachment, which provides no redundancy and violates best practices for high availability across EADs. Option D is wrong because 'One: one session per Cloud Router' ignores the need for per-attachment BGP sessions and fails to account for the separate VLAN attachments in different EADs, which require distinct sessions to maintain path diversity.

Practice this question →

208

MCQeasy

A company needs to resolve DNS queries from their Google Cloud VPC for on-premises hostnames (e.g., internal.mycompany.com). They have a Cloud VPN tunnel between GCP and on-premises. Which approach should they use?

A.Configure an outbound DNS forwarding policy with Cloud Router to forward queries to on-premises DNS servers.

B.Create a DNS forwarding zone in Cloud DNS that points to the on-premises DNS server IPs via the Cloud Router.

C.Create a Cloud DNS private zone and add A records for each on-premises host.

D.Set up a BIND server on a Compute Engine instance and configure it as a forwarder.

AnswerB

This is the correct method: forwarding zone sends queries for the specified domain to on-premises DNS servers.

Why this answer

Cloud DNS forwarding zones allow you to forward queries for a specific domain (e.g., internal.mycompany.com) to on-premises DNS servers via the VPN tunnel.

Practice this question →

209

Multi-Selecthard

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Select 3 answers

A.Incorrect VLAN ID on the VLAN attachment

B.Mismatched BGP hold timer values

C.MTU mismatch causing packet fragmentation

D.Incorrect BGP password (MD5 authentication)

E.Duplicate AS number on the on-premises router

AnswersB, C, D

If the hold timers differ, the session may time out and flap.

Why this answer

BGP session flapping can be caused by mismatched parameters, MTU issues, or authentication problems.

Practice this question →

210

Multi-Selectmedium

You need to monitor the health and performance of a Dedicated Interconnect connection. Which THREE Cloud Monitoring metrics should you use? (Choose three.)

Select 3 answers

A.interconnect/network/received_bytes_count

B.interconnect/link/packets_dropped

C.interconnect/network/sent_packets_count

D.interconnect/link/operational_status

E.interconnect/link/latency

AnswersA, B, D

Monitors inbound traffic volume.

Why this answer

Key metrics include received bytes count (for traffic), operational status (link up/down), and packets dropped (indicates errors or congestion). These are standard interconnect metrics.

Practice this question →

211

MCQmedium

An organization wants to use Cloud DNS to forward DNS queries from on-premises to Google Cloud for a private zone. Which feature should they implement?

A.DNS peering

B.Inbound DNS policy

C.Outbound DNS forwarding zone

D.Private zone with DNS forwarding

AnswerB

Inbound DNS policy creates a forwarding IP that on-premises resolvers can use to query Cloud DNS private zones.

Why this answer

Inbound DNS policy provides a Google-managed forwarding IP address in your VPC that on-premises resolvers can use to forward queries to Cloud DNS private zones.

Practice this question →

212

Multi-Selectmedium

A company has a Dedicated Interconnect connection between their on-premises data center and Google Cloud. They are experiencing intermittent connectivity issues on a specific VLAN attachment. The VLAN attachment is configured with a single Cloud Router and BGP sessions are established. Which two steps should they take to troubleshoot the issue? (Choose two.)

Select 2 answers

A.Verify the BGP session status on the Cloud Router.

B.Check the MTU configuration on the on-premises router.

C.Verify the physical interconnect location and cable connections.

D.Review the VLAN attachment status in the Google Cloud Console.

E.Review the Cloud NAT configuration for the VPC network.

AnswersA, D

Correct. BGP session flapping can cause intermittent connectivity.

Why this answer

BGP session status on the Cloud Router directly indicates whether the routing protocol is functioning correctly between the on-premises router and Google Cloud. Intermittent connectivity on a VLAN attachment often stems from BGP flapping or session drops, which can be verified by checking the BGP state (e.g., Established, Idle, or Active) and associated error counters in the Google Cloud Console or via gcloud commands.

Exam trap

The trap here is that candidates often confuse physical layer issues (Option C) with logical layer problems, but the question specifies a single VLAN attachment, which points to a logical configuration error rather than a physical interconnect fault.

Practice this question →

← PreviousPage 3 of 3 · 212 questions total

Ready to test yourself?

Try a timed practice session using only Implementing Hybrid Interconnectivity questions.

Start 20-question session