Google Professional Cloud Network Engineer Question 667
Single answerGoogle Cloud PlatformYou are tasked with setting up a Classic VPN connection between your Google Cloud environment and an on-premises network. The on-premises network team requires that traffic between the two networks must be explicitly allowed or denied based on specific IP address ranges. Which type of VPN configuration should you choose, and what additional steps are required to meet this requirement?
- A
Route-based VPN, and configure custom static routes in the Google Cloud VPC to direct traffic to the on-premises network.
- B
Policy-based VPN, and define specific source and destination IP ranges in the VPN configuration.
- C
Route-based VPN, and rely on Google Cloud dynamic routing to automatically handle traffic between networks.
- D
Policy-based VPN, and use Cloud Router to dynamically exchange routes between the on-premises network and Google Cloud.
Show answer and explanation
Correct answer: B
Explanation
Policy-based VPN is the correct choice when you need to explicitly allow or deny traffic based on specific IP address ranges. This type of VPN configuration allows you to manually define policies that control which traffic is allowed through the VPN tunnel. Route-based VPN, on the other hand, relies on routing tables or dynamic routing and does not provide the granular control required in this scenario.
- A. Incorrect.
Route-based VPN does not allow you to explicitly define traffic rules based on source and destination IP ranges. It uses routing tables to handle traffic, which is not suitable for this requirement.
- B. Correct.
Policy-based VPN allows you to explicitly define traffic policies based on source and destination IP ranges, making it the correct choice for this scenario.
- C. Incorrect.
Route-based VPN relies on routing tables and dynamic routing, which does not allow for the explicit control of traffic based on IP ranges as required in this scenario.
- D. Incorrect.
Policy-based VPN does not support the use of Cloud Router for dynamic route exchange. Cloud Router is only used with dynamic routing in route-based VPNs.