You want to implement an IPSec tunnel between your on-premises network and a VPC via Cloud VPN. You need to restrict reachability over the tunnel to specific local subnets, and you do not have a devic

Question

Options

• ADynamic routing using Cloud Router
• BRoute-based routing using default traffic selectors
• CPolicy-based routing using a custom local traffic selector
• DPolicy-based routing using the default local traffic selector

• A
  5% (2)
• B
  2% (1)
• C
  84% (36)
• D
  9% (4)

Explanation

Policy-based routing with a custom local traffic selector (C) is the correct choice when you need to restrict which local subnets are reachable over the tunnel and the device does not support BGP. In GCP Cloud VPN, policy-based tunnels use traffic selectors to define which source (local) and destination (remote) IP ranges are permitted through the tunnel - essentially forming the IPSec Security Associations. A 'custom' local traffic selector lets you specify only the specific subnets you want to expose, as opposed to the default selector (0.0.0.0/0) which would advertise all local routes. Dynamic routing (A) requires BGP via Cloud Router, which is explicitly ruled out. Route-based routing (B) uses default traffic selectors (0.0.0.0/0) and does not restrict to specific subnets. Option D's default local traffic selector would not restrict reachability.

No community discussion yet for this question.