Exam Professional Cloud Architect topic 1 question 191 discussion

A is true only if the on-prem (peer) gateway has two separate external P addresses. The HA VPN gateway uses two tunnels, one tunnel to each external IP address on the peer device as described in https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#configurations_that_support_9999_availability C is a complete solution that provides full redundancy of the on-prem gateway. This is probably more expensive and having two HA VPN Gateways is an unusual configuration as the online documentation only describes using one HA VPN Gateway A appears to be correct with assumptions...!

A can provide 99.99% availability as well, and no need for C which will be more expensive. https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#1-peer-1-address

D is correct. A. Single HA Cloud VPN with Two Tunnels: This offers redundancy, but a single point of failure exists at the Cloud VPN gateway itself. A second HA Cloud VPN gateway provides additional fault tolerance. B. Two Classic Cloud VPNs with Multiple Tunnels: Classic Cloud VPNs are being phased out and might be less cost-effective than HA Cloud VPNs. Additionally, managing multiple Classic Cloud VPN gateways can be more complex. D. Single Cloud VPN Gateway: This offers a single point of failure and wouldn't achieve the desired level of high availability.

why not B? See https://cloud.google.com/network-connectivity/docs/vpn/concepts/classic-topologies#option-3 Don't you need redundant VPN gateways on the other side (on-prem) to reach close to 100% availability? A) has a single VPN gateway on-prem.

A: looks an exact match for the requirements, 99.99% availability B: Is a manual implementation of HA, not optimizing cost C: Is behoynd HA, no longer optimizing cost. D: Does not provide close to 100% as possible

Use HA (High Availability) VPN as required in the question. A is better aswer.

both A and C are possible solutions but A is cheaper.

A is ok

Correct Answer is D, You cannot migrate an existing Cloud VPN tunnel or tunnels on a Classic VPN gateway to an HA VPN gateway. Instead, you need to create new tunnels and delete the old ones. https://cloud.google.com/network-connectivity/docs/vpn/how-to/moving-to-ha-vpn#general_guidelines

A satisfty both requriements

A is right

best explained in https://jayendrapatil.com/tag/classic-vpn-vs-ha-vpn/ HA VPN provides an SLA of 99.99% service availability, when configured with two interfaces and two external IP addresses.

To meet the 99.99% SLA on the Google Cloud side, there must be a tunnel from each of the two interfaces on the HA VPN gateway to the corresponding interfaces on the peer gateway.

A can provide 99.99% availability as well, and no need for C which will be more expensive. https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#1-peer-1-address

C is full mash. real HR with redundancy on the on premises site

I choose A. Gives you 99.99% availability, and is certainly cheaper than B, C and is more reliable than D. https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies

https://cloud.google.com/static/network-connectivity/docs/vpn/images/ha-vpn-gcp-to-on-prem-2-a.svg