Exam Professional Cloud Network Engineer topic 1 question 170 discussion

It is AC

A (Route-based): Less likely to work due to the peer's SA requirement conflicting with the typical 0.0.0.0/0 selectors used in route-based VPNs. While generally recommended by Google, it might not be applicable here. B (Single Policy-based, 30 CIDRs): A valid approach if the peer device supports negotiating multiple Child SAs based on the provided traffic selectors within a single IKEv2 negotiation. Google Cloud supports this configuration. C (Multiple Policy-based, Unique Peer IPs): Requiring unique peer IPs is explicitly contradicted by documentation which states multiple tunnels can connect to the same peer IP and that tunnels on the same Classic VPN gateway must connect to unique peer IPs (implying multiple tunnels to the same peer IP requires multiple GCP gateways or careful configuration, but connecting multiple tunnels to the same peer IP is possible). This option is impractical. D (Multiple Policy-based, 10 CIDRs each): Arbitrary grouping, less standard than B or E.

A & C Answer here: recheck this link and check your answer https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing#route-alignment

IKEv1 supports 1 CIDR for each VPN and on SA for each IKEv2 supports up to 30 CIDR for each VPN but all of them share one SA as the current VPN use unique SA for each CIDR then we can't use IKEV2.. not B

B. Create a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors. D. Create multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the remote traffic selectors. Policy-based routing allows you to specify which traffic is sent over specific tunnels based on the local and remote traffic selectors (CIDR blocks). You can either create a single tunnel with 30 remote traffic selectors (option B) or create multiple tunnels, each with up to 10 remote traffic selectors (option D). Option A is incorrect because route-based VPNs require BGP, which your on-premises network does not support. Options C and E are incorrect because they suggest creating a tunnel for each CIDR block, which would result in 30 tunnels. This is unnecessary and would increase complexity and management overhead.

The documentation points towards A+C: https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing?hl=en#route-alignment For A: "Use a route-based VPN. Both traffic selectors are 0.0.0.0/0 by definition for route-based VPNs. You can create routes that are more specific than the traffic selectors." For C: "Use policy-based routing to create multiple Cloud VPN tunnels so that each tunnel only has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. (...) Your peer VPN gateway must offer separate external IP addresses to which each Cloud VPN tunnel can connect. Tunnels on the same Classic VPN gateway must connect to unique peer gateway IP addresses."

Answer A&B are correct.

B&C : https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing

The correct methods are options A and C.