PCNE Practice Question: Designing, Planning, and Prototyping a GCP Network
A company is designing a hybrid network with Cloud VPN. Which TWO best practices should they follow? (Choose TWO.)
⚠ Common exam trap
It's easy for candidates to assume static routes are simpler and therefore better for hybrid networks, but the PCNE exam emphasizes dynamic routing (BGP) for reliability and scalability, and they may also overlook the need for multiple tunnels for redundancy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use pre-shared keys for authentication.
Pre-shared keys (PSKs) are a valid and commonly used authentication method for IPsec VPN tunnels in Google Cloud. They provide a simple, symmetric key-based mechanism to authenticate the VPN peers without requiring a PKI infrastructure, making them a best practice for straightforward deployments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a VPN tunnel per subnet.
Why it's wrong here
One tunnel with BGP can handle multiple subnets.
- ✗
Use static routes for simplicity.
Why it's wrong here
Static routes are not recommended; dynamic routing with BGP is preferred for HA.
- ✓
Use pre-shared keys for authentication.
Why this is correct
Pre-shared keys are the default authentication method for Cloud VPN.
- ✓
Use BGP with Cloud Router for dynamic routing.
Why this is correct
BGP enables route exchange and failover.
- ✗
Use a single VPN tunnel for all traffic.
Why it's wrong here
For HA, two tunnels are recommended; one tunnel is not HA.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.