Google ACE Planning and Configuring a Cloud Solution Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create one classic VPN gateway with two tunnels to the two on-premises devices

  Why it's wrong here

  A classic VPN gateway is a single point of failure because it has no redundant interfaces; even if you create two tunnels from it to two on-premises devices, the gateway itself and its single external IP are shared, so a failure of the gateway or the underlying tunnel terminator takes down both tunnels. Classic VPN also does not offer the 99.99% uptime SLA that HA VPN provides, because there is no active/active pair to fail over. Therefore this configuration cannot satisfy the need for a resilient link to both on-premises routers.

• ✓

  Create one HA VPN gateway with two interfaces in the same region, and create two tunnels, each connecting one cloud interface to one on-premises device

  Why this is correct

  This is the exact HA VPN architecture: one regional HA VPN gateway exposes two external IP addresses (called interfaces) in the same region, and each interface forms its own IPsec tunnel to a different on-premises device. The two tunnels run as an active/active or active/standby pair using BGP dynamic routing, so if one on-premises device or tunnel fails, the Cloud Router can withdraw routes and send traffic through the surviving tunnel. This configuration is required to meet the 99.99% availability SLA for Cloud VPN.

• ✗

  Create two separate VPN gateways, each with one interface, and assign each to a different region

  Why it's wrong here

  Creating two separate VPN gateways in different regions does not create an HA VPN gateway pair; each gateway has only one interface, so no two interface/tunnel redundancy exists at the gateway level. Traffic from the on-premises devices would have to choose between two different regional endpoints, which can cause asymmetric routing, different BGP route preferences, and inconsistent failover behavior if one region becomes unreachable. The HA VPN model specifically requires two interfaces on a single regional gateway, not two independently deployed gateways.

• ✗

  Create one HA VPN gateway in one region and one classic VPN gateway in another region

  Why it's wrong here

  Mixing an HA VPN gateway in one region with a classic VPN gateway in another region creates two dissimilar tunnel endpoints that are not designed to work as a failover pair. The classic VPN gateway has no 99.99% SLA and uses a different external IP/auth model, and its tunnel won't participate in the HA VPN's interface-level health checking or automatic BGP failover. If the classic gateway fails, traffic may still prefer the HA tunnel but failover is not coordinated, leaving you without the guaranteed redundancy you need.

Go deeper

Related to this question