mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Has a VPC with subnets in us-central1 and…
An organization has a VPC with subnets in us-central1 and europe-west1. They want to allow traffic from a specific on-premises IP range to reach a Compute Engine instance in europe-west1, but only through a single Cloud VPN tunnel attached to the us-central1 gateway. What configuration is required?
⚠ Common exam trap
Watch out — candidates often assume routes must be created in the same region as the destination instance, but in a global VPC, a route in one region can direct traffic to instances in another region as long as the next hop is valid and the traffic enters through the correct gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a route in us-central1 with the on-premises range and next hop set to the VPN tunnel. Add a firewall rule allowing the traffic.
The VPN tunnel is attached to the us-central1 gateway, and a static route in us-central1 with the on-premises IP range as the destination and the VPN tunnel as the next hop directs traffic from the on-premises network to the VPC. Since the VPC is global, the route applies to all regions, and the Compute Engine instance in europe-west1 is reachable as long as the traffic enters the VPC through the us-central1 tunnel. A firewall rule is required to allow the inbound traffic from the on-premises range to the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a route in us-central1 with the on-premises range and next hop set to the VPN tunnel. Add a firewall rule allowing the traffic.
Why this is correct
Creating a regional route in us-central1 with the on-premises CIDR as the destination and the Cloud VPN tunnel as the next hop is the standard way to direct that traffic through the desired tunnel. Because the VPN tunnel is a regional resource in us-central1, the route must be created in that same region. Additionally, a firewall rule must allow the traffic from the source VPC subnets to the on-premises range, otherwise the packets are dropped even with a valid route.
- ✗
Use policy-based routing on the Cloud VPN gateway to route the traffic to europe-west1.
Why it's wrong here
Google Cloud Cloud VPN does not support policy-based routing, which matches traffic by source/destination pairs and applies distinct rules per pair. Instead, it is route-based: forwarding decisions rely on VPC routes that use the VPN tunnel as a next hop, or on BGP-learned routes. Attempting to configure policy-based routing on the Cloud VPN gateway is not a valid operation in GCP.
- ✗
Create a static route for the on-premises range in the europe-west1 subnet pointing to the VPN tunnel in us-central1.
Why it's wrong here
VPC routes are regional resources, and a route's next hop (in this case a Cloud VPN tunnel) must be in the same region as the route itself. A static route created in europe-west1 with a next hop pointing to a tunnel in us-central1 is invalid because the tunnel is not a local resource to europe-west1. Moreover, even if the route were accepted, traffic from europe-west1 would still need to traverse the inter-region backbone to reach the tunnel, which does not help in forcing it through the desired tunnel.
- ✗
Configure the VPN tunnel with BGP to advertise the on-premises range to both regions.
Why it's wrong here
BGP is used to exchange routing information; it does not dictate which tunnel handles ingress traffic from a particular region. When BGP advertises the on-premises range, each region's VPC route table learns the route independently, and VM traffic follows the regional route's next hop. To force all traffic through the us-central1 tunnel, you need a static route in us-central1 with that tunnel as the next hop; BGP alone cannot prioritize one tunnel over another for forwarding.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.