hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A company has 50+ Compute Engine instances…
A company has 50+ Compute Engine instances running a stateful application in the us-central1 region. The instances are part of a managed instance group behind an internal load balancer. The application stores data on zonal persistent disks. The company wants to migrate the entire application stack to the europe-west1 region to reduce latency for European users. They have a Cloud VPN tunnel between their on-premises data center and us-central1. They want to extend connectivity to europe-west1 with minimal downtime. The current on-premises router uses BGP to advertise a specific CIDR block (10.0.0.0/8) to Google Cloud. The VPC is in custom mode with subnets in us-central1 and europe-west1 already created. The Cloud VPN gateway in us-central1 is attached to a Cloud Router with a BGP session to the on-premises router. Which course of action should the company take to achieve the migration with minimal downtime?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new Cloud VPN gateway in europe-west1, attach it to a Cloud Router, and establish a BGP session with the on-premises router. Use route priority or metrics to gradually shift traffic to europe-west1.
Adding a second Cloud VPN gateway in europe-west1 and configuring a new BGP session to the on-premises router allows the on-premises router to learn routes for europe-west1 subnets and route traffic accordingly. This can be done without modifying existing sessions, and traffic can be shifted gradually by adjusting route priority (MED) or using BGP metrics. Option A is wrong because a second VPN tunnel on the same gateway would still be in us-central1 and might not provide optimal routing. Option B is wrong because VPC Network Peering does not extend on-premises connectivity; it only connects VPC networks, and the on-premises router would still only have a BGP session to the us-central1 Cloud Router. Option D is wrong because Dedicated Interconnect is a dedicated physical connection that requires significant provisioning time and may not be suitable for a quick migration, and it does not inherently allow gradual traffic shifting without additional BGP configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a second Cloud VPN tunnel on the existing Cloud VPN gateway to Europe with a new BGP session, and update the on-premises router to accept the new route advertisement.
Why it's wrong here
The existing Cloud VPN gateway is a regional resource in us-central1, so adding a second tunnel through that same gateway to Europe still forces traffic to land in us-central1 before traversing Google's backbone to europe-west1. The new BGP session would also originate from the us-central1 Cloud Router, meaning the on-premises router would keep sending packets to the same US entry point and latency would remain high. This approach fails to establish a local entry point in Europe; you need a gateway physically located in europe-west1 to give on-premises traffic a low-latency path.
- ✗
Set up VPC Network Peering between the us-central1 and europe-west1 VPCs to allow cross-region communication.
Why it's wrong here
VPC Network Peering creates private connectivity between two VPC networks, not between a VPC and an on-premises network; it cannot replace the IPsec VPN tunnel that the company still needs. Even if the two VPCs were peered, the on-premises router would never learn routes for europe-west1 subnets through peering, because peering is not a BGP-based external connection. This option would only help internal VPC-to-VPC communication and does nothing to move the company's on-premises traffic to europe-west1.
- ✓
Create a new Cloud VPN gateway in europe-west1, attach it to a Cloud Router, and establish a BGP session with the on-premises router. Use route priority or metrics to gradually shift traffic to europe-west1.
Why this is correct
A new Cloud VPN gateway in europe-west1 with its own Cloud Router gives the on-premises router a second BGP session and a new set of routes to the europe-west1 subnets, allowing traffic to enter GCP at the closest region. By adjusting BGP route priority or MED values, you can gradually shift a percentage of traffic to the new tunnel while monitoring application health and roll back if needed. Because both tunnels remain up during the transition, there is no downtime and the Cloud Router can automatically fail over if one tunnel fails.
- ✗
Provision a Dedicated Interconnect connection to europe-west1 and attach a new Cloud Router. Remove the existing Cloud VPN gateway.
Why it's wrong here
Dedicated Interconnect requires physical cross-connects at a GCP co-location facility and typically takes weeks or months to provision, so it is not a quick migration step for 50 stateful instances. More importantly, the proposed action removes the existing Cloud VPN gateway before the new Interconnect is verified, which would immediately cut off connectivity to us-central1 and cause downtime. Even if Interconnect were desirable long-term, it should be provisioned in parallel and the VPN should only be decommissioned after the new path is stable and tested.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.