Google ACE Planning and Configuring a Cloud Solution Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure the HA VPN gateway with two interfaces and use BGP to load balance traffic

  Why it's wrong here

  HA VPN gateways have two interfaces with separate public IP addresses, which are designed to terminate two independent tunnels to two distinct on-premises public IPs. If the peer gateway exposes only one public IP, you cannot connect both HA VPN interfaces to it in an active/active BGP load-balancing design, because that would require the on-premises device to host two BGP sessions for two different tunnel endpoints using a single IP. The single-IP peer means the second tunnel cannot be terminated, so the two-interface BGP load-balancing configuration is not viable.

• ✗

  Use a Cloud Router with custom route advertisements to the on-premises network

  Why it's wrong here

  Cloud Router is only the BGP control-plane component for HA VPN; it exchanges routes and applies route priority, but it does not change the physical tunnel endpoint limitation. Custom route advertisements can control which VPC ranges and on-premises prefixes are propagated, yet they have no effect on the number of IP addresses the on-premises VPN peer can use. The peer's single IP prevents two tunnels regardless of what prefixes or BGP attributes Cloud Router advertises, so this option does not address the core problem.

• ✗

  Create a Classic VPN tunnel instead of HA VPN

  Why it's wrong here

  Classic VPN tunnels are a legacy offering that support only one tunnel per gateway and do not provide the built-in redundancy of HA VPN. Although a Classic VPN could technically connect to a peer with a single IP, the question specifically concerns configuring HA VPN, and replacing it with Classic VPN changes the architecture rather than configuring HA VPN for the peer's constraint. The lack of a second interface avoids the single-IP issue, but it sacrifices the high availability, failover, and service-level objective that HA VPN is meant to provide.

• ✓

  Configure the HA VPN gateway with only one interface and disable the second interface

  Why this is correct

  For a peer VPN device that has only one public IP address, HA VPN supports using just one of its two interfaces: you create one tunnel from that interface and leave the second interface disabled or without a tunnel. This preserves the HA VPN gateway object and allows the existing Cloud Router/BGP session to operate over the single tunnel, matching the on-premises endpoint's capability. It is the documented configuration when the peer lacks the second IP needed for a fully redundant HA VPN pair.

Go deeper

Related to this question