Google Professional Cloud Network Engineer Question 653
Select 3Google Cloud PlatformYour organization needs to establish a highly available VPN connection between its on-premises data center and Google Cloud. The organization is already using a Dedicated Interconnect with a VLAN attachment configured. To ensure HA VPN works seamlessly over Cloud Interconnect, which of the following steps should you take?
- A
Create two separate HA VPN gateways in different regions.
- B
Configure two Cloud Router instances, one associated with each HA VPN gateway.
- C
Set up two VLAN attachments for the Dedicated Interconnect in the same region, each associated with different Cloud Router instances.
- D
Ensure that each HA VPN gateway has two interfaces connected to separate IPsec tunnels.
- E
Configure BGP sessions between the Cloud Routers and the on-premises routers.
Show answer and explanation
Correct answers: B, D, E
Explanation
To configure HA VPN over Cloud Interconnect, you need to ensure dynamic routing is properly set up using Cloud Routers, which are essential for route advertisement and failover. Each HA VPN gateway must have two interfaces to establish separate IPsec tunnels, providing redundancy. Additionally, BGP sessions must be configured between the Cloud Routers on the Google Cloud side and the on-premises routers to enable dynamic route exchange and high availability. While VLAN attachments are important for Dedicated Interconnect, they should be configured in different availability zones, not in the same region, as high availability depends on regional diversity.
- A. Incorrect.
Incorrect: HA VPN gateways should be created for high availability, but they do not need to be in separate regions. Both gateways can reside in the same region as long as they are configured for redundancy.
- B. Correct.
Correct: Each HA VPN gateway needs to be associated with a Cloud Router to dynamically exchange routes using BGP.
- C. Incorrect.
Incorrect: While VLAN attachments are used for Dedicated Interconnect, they should reside in different availability zones, not the same region, to ensure high availability.
- D. Correct.
Correct: HA VPN gateways require two interfaces, with each interface configured for a separate IPsec tunnel to provide redundancy.
- E. Correct.
Correct: BGP is required to dynamically exchange routes between the Cloud Routers and the on-premises routers, enabling seamless failover and high availability.