Google Professional Cloud Network Engineer Question 666
Single answerGoogle Cloud PlatformYou are configuring a Classic VPN to establish connectivity between your on-premises network and Google Cloud. Your on-premises VPN device supports route-based VPNs but not policy-based VPNs. During the configuration, you notice that the VPN tunnel is not coming up. What could be a possible reason?
- A
The on-premises VPN device is misconfigured to use policy-based VPN.
- B
The Cloud Router has not been configured to exchange dynamic routes.
- C
The pre-shared key (PSK) does not match between Google Cloud and the on-premises VPN device.
- D
The Classic VPN does not support route-based VPNs.
Show answer and explanation
Correct answer: A
Explanation
Classic VPN supports both route-based and policy-based VPNs. However, the VPN devices on both ends must be configured properly to use the same type of VPN. In this scenario, the on-premises VPN device supports route-based VPNs, but if it is misconfigured to use policy-based VPN, the tunnel will not come up. Ensuring that both sides are configured consistently is critical for establishing the VPN connection.
- A. Correct.
Correct. If the on-premises VPN device is misconfigured to use policy-based VPN, it will not match the route-based VPN configuration on Google Cloud, causing the tunnel to fail.
- B. Incorrect.
Incorrect. Cloud Router is not required for Classic VPN to establish a basic connection when using static routing. This is only relevant if you are using dynamic routing with BGP.
- C. Incorrect.
Incorrect. While a mismatched pre-shared key can cause issues, the scenario specifically mentions the device supports route-based VPNs, so the configuration mismatch is a more likely reason for the issue.
- D. Incorrect.
Incorrect. Classic VPN does support route-based VPNs. The issue lies in the configuration of the on-premises VPN device.