Exam Professional Cloud Network Engineer topic 1 question 170 discussion

B: Since the on-premises network does not support the Border Gateway Protocol (BGP), you must use a VPN with static routing. Policy-based routing is a type of static routing where you define the specific IP ranges (traffic selectors) that can communicate through the tunnel. D: This approach is a variation of policy-based routing that enhances manageability and can help avoid potential limits on the number of SAs or policies within a single tunnel on either the Google Cloud or the on-premises side. By splitting the 30 CIDR ranges across three separate tunnels (10 CIDRs each), you still achieve the same connectivity goal

It is AC

A (Route-based): Less likely to work due to the peer's SA requirement conflicting with the typical 0.0.0.0/0 selectors used in route-based VPNs. While generally recommended by Google, it might not be applicable here. B (Single Policy-based, 30 CIDRs): A valid approach if the peer device supports negotiating multiple Child SAs based on the provided traffic selectors within a single IKEv2 negotiation. Google Cloud supports this configuration. C (Multiple Policy-based, Unique Peer IPs): Requiring unique peer IPs is explicitly contradicted by documentation which states multiple tunnels can connect to the same peer IP and that tunnels on the same Classic VPN gateway must connect to unique peer IPs (implying multiple tunnels to the same peer IP requires multiple GCP gateways or careful configuration, but connecting multiple tunnels to the same peer IP is possible). This option is impractical. D (Multiple Policy-based, 10 CIDRs each): Arbitrary grouping, less standard than B or E.

A & C Answer here: recheck this link and check your answer https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing#route-alignment

IKEv1 supports 1 CIDR for each VPN and on SA for each IKEv2 supports up to 30 CIDR for each VPN but all of them share one SA as the current VPN use unique SA for each CIDR then we can't use IKEV2.. not B

B. Create a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote traffic selectors. D. Create multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the remote traffic selectors. Policy-based routing allows you to specify which traffic is sent over specific tunnels based on the local and remote traffic selectors (CIDR blocks). You can either create a single tunnel with 30 remote traffic selectors (option B) or create multiple tunnels, each with up to 10 remote traffic selectors (option D). Option A is incorrect because route-based VPNs require BGP, which your on-premises network does not support. Options C and E are incorrect because they suggest creating a tunnel for each CIDR block, which would result in 30 tunnels. This is unnecessary and would increase complexity and management overhead.

The documentation points towards A+C: https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing?hl=en#route-alignment For A: "Use a route-based VPN. Both traffic selectors are 0.0.0.0/0 by definition for route-based VPNs. You can create routes that are more specific than the traffic selectors." For C: "Use policy-based routing to create multiple Cloud VPN tunnels so that each tunnel only has one CIDR block for its local traffic selector and one CIDR block for its remote traffic selector. (...) Your peer VPN gateway must offer separate external IP addresses to which each Cloud VPN tunnel can connect. Tunnels on the same Classic VPN gateway must connect to unique peer gateway IP addresses."

Answer A&B are correct.

B&C : https://cloud.google.com/network-connectivity/docs/vpn/concepts/choosing-networks-routing

The correct methods are options A and C.