nerdexam
Google

PROFESSIONAL-CLOUD-NETWORK-ENGINEER · Question #184

You are configuring your organization's Google Cloud environment to connect to your on- premises network, which does not support Border Gateway Protocol (BGP). Your on-premises network has 30 CIDR…

The correct answer is A. Create a single Cloud VPN tunnel that uses route-based VPN. C. Create multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one. To connect to an on-premises network not supporting BGP with 30 CIDR ranges, where the on-premises VPN gateway creates a unique child SA per CIDR, you can use either a single route-based VPN tunnel or 30 separate policy-based VPN tunnels.

Submitted by klara.se· Apr 18, 2026Designing, planning, and prototyping a Google Cloud network

Question

You are configuring your organization's Google Cloud environment to connect to your on- premises network, which does not support Border Gateway Protocol (BGP). Your on-premises network has 30 CIDR ranges that must be reachable from Google Cloud. Your VPN gateway creates a unique child security association (SA) per CIDR. You must ensure that the 30 CIDR ranges in your on-premises network are reachable from Google Cloud. Following Google-recommended practices, which two methods can you use to accomplish this? (Choose two.)

Options

  • ACreate a single Cloud VPN tunnel that uses route-based VPN.
  • BCreate a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote
  • CCreate multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one
  • DCreate multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the
  • ECreate multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one

How the community answered

(24 responses)
  • A
    83% (20)
  • B
    4% (1)
  • D
    4% (1)
  • E
    8% (2)

Why each option

To connect to an on-premises network not supporting BGP with 30 CIDR ranges, where the on-premises VPN gateway creates a unique child SA per CIDR, you can use either a single route-based VPN tunnel or 30 separate policy-based VPN tunnels.

ACreate a single Cloud VPN tunnel that uses route-based VPN.Correct

A single route-based Cloud VPN tunnel allows for the configuration of multiple static routes on the Google Cloud side to reach all 30 on-premises CIDR ranges, serving as a viable method when BGP is not supported.

BCreate a single Cloud VPN tunnel that uses policy-based routing with 30 CIDRs as the remote

Google Cloud Classic VPN policy-based tunnels support only one remote IP range per tunnel, making it impossible to configure a single tunnel with 30 remote CIDRs.

CCreate multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has oneCorrect

When an on-premises VPN gateway creates a unique child security association (SA) per CIDR and does not support BGP, creating multiple policy-based Cloud VPN tunnels-one for each of the 30 on-premises CIDR ranges-is a recommended approach for establishing connectivity.

DCreate multiple Cloud VPN tunnels that use policy-based routing with 10 CIDR per tunnel as the

Google Cloud Classic VPN policy-based tunnels support only one remote IP range per tunnel, therefore configuring 10 CIDRs per tunnel is not possible.

ECreate multiple Cloud VPN tunnels that use policy-based routing so that each tunnel has one

This option is identical to option C and is therefore technically correct, but A and C are specifically marked as the correct pair.

Concept tested: Classic VPN (route-based vs. policy-based) with multiple CIDRs

Source: https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#static-routes-vpn

Topics

#Cloud VPN#Policy-based VPN#Route-based VPN#Hybrid Connectivity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice