Google Professional Cloud Network Engineer Question 668
Single answerGoogle Cloud PlatformYour company is setting up a Classic VPN to establish secure connectivity between its Google Cloud VPC network and an on-premises data center. The on-premises VPN gateway only supports policy-based VPNs. What must you do when configuring the Classic VPN on the Google Cloud side to ensure compatibility with the on-premises VPN gateway?
- A
Configure the VPN tunnel as policy-based and specify the IP ranges for traffic selectors.
- B
Enable dynamic (BGP) routing to automatically exchange routing information.
- C
Configure the VPN tunnel as route-based and use Cloud Router for dynamic routing.
- D
Use IKEv2 instead of IKEv1 for VPN negotiation.
Show answer and explanation
Correct answer: A
Explanation
To ensure compatibility with an on-premises VPN gateway that only supports policy-based VPNs, the Google Cloud Classic VPN tunnel must also be configured as policy-based. This involves specifying traffic selectors (IP ranges) to match the on-premises configuration. Route-based VPNs and dynamic routing are not compatible with policy-based VPNs.
- A. Correct.
Correct. Policy-based VPNs require you to specify IP ranges (traffic selectors) for the VPN tunnel to match the on-premises configuration.
- B. Incorrect.
Incorrect. Policy-based VPNs do not support dynamic (BGP) routing, as they rely on fixed traffic selectors rather than dynamic route exchange.
- C. Incorrect.
Incorrect. Route-based VPNs are incompatible with a policy-based VPN gateway on the on-premises side.
- D. Incorrect.
Incorrect. While IKEv2 can provide better performance and security, it is not relevant to ensuring compatibility with a policy-based VPN.