Overview
Where Section 1 decides which hybrid option to use, this section configures it. Cloud Interconnect covers Dedicated Interconnect circuits, Partner Interconnect at Layer 2 or Layer 3, Cross-Cloud Interconnect to another cloud provider, VLAN attachments, HA VPN over Cloud Interconnect for encryption, and the topologies that meet the 99.9% and 99.99% SLAs. VPN work covers HA VPN to on-premises peer gateways and between VPC networks, plus Classic VPN in route-based or policy-based form.
Cloud Router ties everything together with BGP. You set ASNs, MED-based route priority, link-local peering addresses and MD5 authentication, enable Bidirectional Forwarding Detection, create custom advertised and custom learned routes, and choose legacy or standard best path selection. Network Connectivity Center returns with hybrid spokes, site-to-site data transfer, router appliance spokes and transitivity fixes.
How it's tested
Hybrid questions usually describe existing circuits or tunnels, a resilience or traffic engineering goal, and some limitation such as no colocation presence or an encryption mandate. You choose the connection type, the redundancy layout or the BGP setting that delivers the goal.
-
Meet the SLA
You count connections, edge availability domains, metros, regions and tunnels needed for 99.9% or 99.99% availability.
-
Steer traffic with BGP
You use advertised route priority, custom advertisements, custom learned routes or best path selection to prefer one link.
-
Connect sites through Google
You use Network Connectivity Center hybrid spokes, site-to-site data transfer or router appliances for transit needs.
A company has two Dedicated Interconnect connections in one metro and wants on-premises traffic to use connection A, with B only as backup. Both VLAN attachments advertise the same prefixes. Setting a higher advertised route priority on the BGP session over B makes Google's advertisements on B less preferred, since on-premises routers prefer the lower MED, so A carries traffic until it fails.
Objectives 4
Official objectives from the Google Cloud outline, in outline order.
4.1 Configuring Cloud InterconnectDedicated, Partner and Cross-Cloud Interconnect, VLAN attachments, HA VPN over Interconnect and SLA topologies.
- What it means
- This objective covers ordering and configuring each Cloud Interconnect type, creating VLAN attachments, adding HA VPN over Cloud Interconnect when traffic must be encrypted, and building redundant layouts that qualify for the 99.9% or 99.99% availability SLA.
- What to understand
- Dedicated Interconnect provides 10 Gbps or 100 Gbps physical circuits that you connect at a colocation facility, then use VLAN attachments with Cloud Router BGP sessions. Partner Interconnect attachments range from 50 Mbps upward; with a Layer 2 partner you configure BGP to Cloud Router yourself, while a Layer 3 partner runs BGP for you. Cross-Cloud Interconnect uses Google-managed links to providers such as AWS, Azure and Oracle Cloud. A 99.9% layout needs two connections in different edge availability domains of one metro; 99.99% needs that in two metros with Cloud Routers in two regions and global dynamic routing.
- How it shows up
- Questions test which components and how many are needed, and who runs BGP for each partner type.
- Common confusion
- A Layer 3 partner handles BGP; a Layer 2 partner leaves BGP configuration to you.
4.2 Configuring a site-to-site IPSec VPNHA VPN to on-premises, HA VPN between VPCs, and Classic VPN.
- What it means
- This objective covers setting up IPsec tunnels with Cloud VPN: HA VPN gateways connected to on-premises peer VPN gateways, HA VPN between two Google Cloud VPC networks, and Classic VPN using route-based or policy-based configuration.
- What to understand
- An HA VPN gateway has two interfaces with two external IP addresses. The 99.99% SLA requires tunnels from both interfaces to a correctly configured peer, and HA VPN uses BGP through Cloud Router. Between two VPCs, you pair two HA VPN gateways with two tunnels each way. Classic VPN has one interface and a 99.9% SLA, and supports static routing with route-based or policy-based (traffic selector) tunnels. Each tunnel has a throughput limit, so more bandwidth comes from more tunnels with ECMP. IPsec overhead reduces usable packet size, which matters for MTU planning.
- How it shows up
- Look for SLA wording, a need for static routing, or a bandwidth figure that a single tunnel cannot carry.
- Common confusion
- HA VPN with only one active tunnel does not qualify for the 99.99% SLA.
4.3 Configuring Cloud RouterBGP attributes, BFD, custom advertised and learned routes, and best path selection modes.
- What it means
- This objective covers the BGP settings on Cloud Router sessions: ASN, advertised route priority (MED), link-local peering addresses and MD5 authentication, Bidirectional Forwarding Detection, custom route advertisements and custom learned routes, and choosing legacy or standard best path selection for a VPC.
- What to understand
- Cloud Router needs a private ASN or Google's 16550 for Partner Interconnect. BGP sessions use link-local addresses from 169.254.0.0/16. Advertised route priority is sent to peers as MED; lower values are preferred. Custom advertisements can add ranges such as the private or restricted Google API VIPs or peered VPC subnets. Custom learned routes install routes for a peer that cannot advertise them over BGP. BFD detects link failure in under a second instead of waiting for BGP hold timers. Standard best path selection considers AS path length and other BGP attributes, unlike the legacy mode.
- How it shows up
- Expect traffic engineering and failover timing questions answered by MED, custom routes or BFD.
- Common confusion
- MED influences how on-premises chooses Google paths; it does not control Google's choice of on-premises paths.
4.4 Configuring Network Connectivity CenterHybrid spokes, site-to-site data transfer, router appliances and transitivity troubleshooting.
- What it means
- This objective covers using Network Connectivity Center for hybrid traffic: attaching VPN tunnels and VLAN attachments as hybrid spokes, enabling site-to-site data transfer between on-premises locations through Google's network, adding router appliance spokes for third-party SD-WAN or routing VMs, and fixing transitivity problems.
- What to understand
- Hybrid spokes group HA VPN tunnels or VLAN attachments under a hub. With site-to-site data transfer enabled, which is available only in supported locations, branch offices can reach each other across Google's backbone. Router appliance spokes let a VM running SD-WAN or routing software peer with Cloud Router over BGP and exchange routes with the hub. Transitivity problems often come from spokes in the wrong topology group, disabled data transfer, export filters or missing route advertisements.
- How it shows up
- Look for branch-to-branch traffic or SD-WAN appliances that must exchange routes dynamically with Google Cloud.
- Common confusion
- Site-to-site data transfer is an explicit spoke setting and is not enabled by default.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
VLAN attachment
Logical link from an Interconnect to a Cloud Router in a region.
- Remember
- Each attachment has its own BGP session.
- Tested as
- Interconnect setup.
- Trap
- Thinking one connection equals one region only.
-
Edge availability domain
Separate maintenance zone within an Interconnect metro.
- Remember
- Redundant connections must use different domains.
- Tested as
- SLA design.
- Trap
- Placing both connections in one domain.
-
Partner Interconnect Layer 2 vs Layer 3
Who configures BGP with Cloud Router.
- Remember
- Layer 2: you; Layer 3: the provider.
- Tested as
- Partner setup questions.
- Trap
- Configuring BGP yourself with a Layer 3 partner.
-
Cross-Cloud Interconnect
Physical link between Google Cloud and another cloud provider.
- Remember
- Google provisions the cross-connect.
- Tested as
- Multicloud bandwidth.
- Trap
- Using Partner Interconnect to reach another cloud.
-
HA VPN over Cloud Interconnect
IPsec tunnels running across encrypted VLAN attachments.
- Remember
- Adds encryption to private circuits.
- Tested as
- Encryption mandates.
- Trap
- Assuming Interconnect traffic is encrypted.
-
HA VPN gateway
Two-interface VPN gateway that uses BGP.
- Remember
- 99.99% SLA needs both interfaces used.
- Tested as
- Resilient VPN.
- Trap
- Configuring a single tunnel.
-
Classic VPN
Single-interface VPN with static or dynamic routing.
- Remember
- 99.9% SLA; policy-based or route-based.
- Tested as
- Legacy or static routing peers.
- Trap
- Choosing it for the highest availability.
-
Advertised route priority (MED)
Value sent to peers to rank Google's routes.
- Remember
- Lower is preferred.
- Tested as
- Active/backup link design.
- Trap
- Raising it on the link you want active.
-
Custom advertised routes
Prefixes Cloud Router announces beyond subnets.
- Remember
- Used for Google API VIPs and peered ranges.
- Tested as
- On-premises reachability.
- Trap
- Expecting peered VPC routes to be advertised automatically.
-
Custom learned routes
Routes you configure manually on a BGP session.
- Remember
- Helps when the peer cannot advertise.
- Tested as
- Static-like control with BGP.
- Trap
- Confusing them with static routes in the VPC.
-
BFD
Fast link failure detection for BGP sessions.
- Remember
- Sub-second detection versus hold timers.
- Tested as
- Fast failover.
- Trap
- Waiting on BGP hold time defaults.
-
Router appliance spoke
NVA VM that peers with Cloud Router via a hub.
- Remember
- Supports SD-WAN integration.
- Tested as
- Branch connectivity.
- Trap
- Using static routes to an SD-WAN VM.
-
Site-to-site data transfer
Lets on-premises sites communicate through Google's network.
- Remember
- Must be enabled on hybrid spokes in supported locations.
- Tested as
- Branch-to-branch traffic.
- Trap
- Assuming spokes provide it by default.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Interconnect types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Dedicated Interconnect | Your own circuits in a colocation facility. | 10 or 100 Gbps ports. | Unavailable without facility presence. |
| Partner Interconnect | Service provider supplies connectivity. | Attachments from 50 Mbps. | Mixing up Layer 2 and Layer 3 BGP ownership. |
| Cross-Cloud Interconnect | Google-managed link to another cloud. | Direct multicloud with high bandwidth. | It does not reach on-premises sites. |
Cloud VPN gateways
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| HA VPN | Two interfaces, BGP routing. | 99.99% SLA when fully configured. | Static routing is not supported. |
| Classic VPN | One interface, static or dynamic routing. | 99.9% SLA; supports policy-based tunnels. | Choosing it for new high availability designs. |
Influencing hybrid paths
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Advertised route priority | MED on routes Google advertises. | Steers on-premises choice of Google path. | Setting it on the wrong session. |
| Learned route priority | Priority applied to routes received from a peer. | Steers Google's choice of on-premises path. | Expecting MED from on-premises to always win. |
| Custom advertisements | Add or replace announced prefixes. | Controls which ranges on-premises learns. | Dropping subnets when switching to custom mode. |
| BFD | Faster failure detection. | Reduces failover time. | Thinking it changes path preference. |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Partner Interconnect for another cloud
- What candidates pick
- Order Partner Interconnect to link Google Cloud with AWS.
- Why it looks right
- Partners provide flexible connectivity.
- Why it's wrong
- Cross-Cloud Interconnect is the Google-managed physical option for linking directly to another cloud provider.
Clue to watch for The other end is a major public cloud, not a data center.
-
Interconnect is encrypted
- What candidates pick
- Rely on Dedicated Interconnect alone for an encryption requirement.
- Why it looks right
- Private circuits feel secure.
- Why it's wrong
- Interconnect traffic is not encrypted by default; use MACsec or HA VPN over Cloud Interconnect.
Clue to watch for Compliance requires encryption in transit.
-
Lower MED on the backup
- What candidates pick
- Set a lower advertised priority on the backup link.
- Why it looks right
- Lower sounds like less important.
- Why it's wrong
- Lower MED values are preferred, so the backup would become primary.
Clue to watch for Active and backup roles for two links.
-
Classic VPN for 99.99%
- What candidates pick
- Deploy two Classic VPN gateways for top availability.
- Why it looks right
- Two gateways look redundant.
- Why it's wrong
- Only HA VPN with both interfaces configured carries the 99.99% SLA.
Clue to watch for The stated target is 99.99%.
-
Static routes to an SD-WAN VM
- What candidates pick
- Create static routes for every branch prefix pointing to the appliance.
- Why it looks right
- Static routes work without BGP.
- Why it's wrong
- Router appliance spokes exchange routes dynamically with Cloud Router and scale as branches change.
Clue to watch for Many branches that change often.
-
Ignore BGP timers
- What candidates pick
- Accept default failover time for a latency-sensitive link.
- Why it looks right
- BGP will eventually reconverge.
- Why it's wrong
- Hold timers can take tens of seconds; BFD detects failures far faster.
Clue to watch for Failover must complete in about a second.
Answer framework
Use these steps to configure or repair a hybrid or multicloud connection.
- Confirm the connection type from colocation presence, bandwidth, encryption needs and the remote peer: Dedicated, Partner or Cross-Cloud Interconnect, or HA VPN.
- Lay out redundancy for the stated SLA by counting connections, edge availability domains, metros, regions, gateway interfaces and tunnels, and reject layouts that fall short.
- Configure Cloud Router sessions with correct ASNs, link-local addresses and MD5 authentication, and enable BFD wherever fast failover matters.
- Shape routing with advertised priority, custom advertisements and learned routes, and check the VPC dynamic routing mode.
- Add Network Connectivity Center hybrid or router appliance spokes when branch sites or SD-WAN devices must exchange traffic through Google's network.
Practice question
Want more like this? The GCP PCNE practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with the SLA topologies, because many questions depend on them. Draw the 99.9% and 99.99% Interconnect layouts and the HA VPN tunnel layout from memory until you can do it without notes. Add a short table of who runs BGP for each Interconnect type and the bandwidth range of each option.
Most learners cannot order an Interconnect, so get hands-on value from HA VPN. Build two VPCs connected by HA VPN with Cloud Routers, then experiment: change advertised route priority on one tunnel, add a custom advertisement, enable BFD and take a tunnel down to observe failover. Read the Cloud Router logs while doing this, which also prepares you for Section 5.
Finish by reading the Network Connectivity Center documentation for hybrid spokes and router appliances, then answer practice questions that mix SLA counting with BGP preference choices. Note every question you miss and add the rule behind it to your hybrid summary table.
FAQ
How much of the GCP PCNE exam is Configuring and implementing hybrid and multicloud network interconnectivity?
Google weights this hybrid and multicloud interconnectivity section at about 16%, the same as Section 3. Plan for around 8 to 9 questions as an editorial estimate.
Do I need hands-on Interconnect experience?
It helps but is not required. Learn the provisioning steps, VLAN attachment behavior, SLA layouts and BGP ownership from documentation, and practice BGP behavior with HA VPN labs.
What ASN should Cloud Router use?
Use a private ASN of your choice for Dedicated Interconnect and VPN. For Partner Interconnect, Cloud Router uses ASN 16550.
Is Classic VPN still on the exam?
Yes. The guide lists Classic VPN in route-based and policy-based forms, mostly for peers that require static routing. HA VPN is preferred for new designs.
What is the difference between custom advertised routes and custom learned routes?
Custom advertised routes control what Cloud Router announces to the peer. Custom learned routes are prefixes you configure so Google Cloud treats them as if the peer had advertised them.
How does Network Connectivity Center help branches?
With hybrid spokes and site-to-site data transfer, branches connected by VPN or Interconnect can reach each other across Google's network, and router appliance spokes integrate SD-WAN devices.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
Practice questions on Interconnect layouts, HA VPN tunnels and Cloud Router BGP settings show whether your hybrid knowledge is exam ready.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the GCP PCNE AI tutor Get any concept explained your way