Google Cloud Certified Professional Cloud Network Engineer Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  Reason: For non-BGP on-prem devices and IKEv2, Google Cloud VPN supports route-based VPN tunnels that work with IKEv2 and scale better as networks grow. Policy-based VPN (option A/B) is deprecated/not recommended for new deployments; Google discourages policy-based VPN in favor of route-based. 0.0.0.0/0 for local/remote traffic selectors (option D) is not appropriate; traffic selectors should match the actual subnets you intend to route, not all traffic. Therefore, the correct approach is to create a Cloud VPN instance, use a route-based VPN tunnel, configure the proper local/remote subnets, and set up static routes.

• Chose D4

  D is the correct answer: Both policy-based and route-based VPNs in Google Cloud support IKEv2, but with some important distinctions. Policy-based VPNs allow for multiple CIDRs per traffic selector when using IKEv2, while route-based VPNs automatically use 0.0.0.0/0 as traffic selectors and rely on custom static routes. The key requirement is minimal overhead to scale in the future.

• Chose D4

  Policy-based VPNs require defining specific local and remote IP ranges (traffic selectors). When new subnets are added on either side, the VPN tunnel configuration (traffic selectors) must be updated, potentially requiring tunnel recreation, which increases overhead and potential downtime. Route-based VPNs typically use broad traffic selectors (like 0.0.0.0/0). Adding new subnets only requires updating the routes (static routes in this case), not the tunnel configuration itself. This significantly reduces operational overhead and minimizes downtime during network expansion.