PCNE Implementing a Virtual Private Cloud Practice Question
A company is migrating from an on-premises data center to Google Cloud. They have set up a High-Availability VPN (with two tunnels) between their on-premises router and a Cloud VPN gateway in a VPC. They use static routing. The on-premises network uses RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the VPC uses 10.1.0.0/16. They have configured static routes in the VPC for the on-premises ranges pointing to the VPN gateway. However, they notice that traffic from on-premises to the VPC is intermittent: sometimes packets go through tunnel 1, sometimes through tunnel 2, and sometimes they drop. The on-premises router is configured to use both tunnels in an active-active mode with equal-cost multipath (ECMP). What is the most likely cause of the intermittent drops?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change from static routing to dynamic routing (BGP) to allow the Cloud VPN gateway to advertise routes and avoid ECMP issues.
The most likely cause of intermittent drops is that the on-premises router is using ECMP to distribute traffic across both VPN tunnels, but Cloud VPN with static routing does not support ECMP for incoming traffic. This can lead to out-of-order packets or drops for the same flow if packets arrive on different tunnels. Switching to dynamic routing with BGP allows the Cloud VPN gateway to establish BGP sessions over each tunnel, which enables proper route advertisement and ECMP support by creating a single logical interface. BGP routing also allows the gateway to better handle path selection and failover, thus resolving the intermittent drops. Therefore, option B is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the number of tunnels to four to distribute traffic better.
Why it's wrong here
More tunnels can increase complexity and still have ECMP issues.
- ✓
Change from static routing to dynamic routing (BGP) to allow the Cloud VPN gateway to advertise routes and avoid ECMP issues.
Why this is correct
BGP provides better control over path selection and is recommended for HA VPN with multiple tunnels.
- ✗
Set the on-premises router to active-passive mode using only one tunnel at a time.
Why it's wrong here
While this would avoid ECMP issues, it reduces redundancy and throughput, and is not the best practice.
- ✗
Configure traffic selector policies on the VPN tunnels to ensure each tunnel only handles specific subnets.
Why it's wrong here
Traffic selectors are for IKE, but do not fix ECMP issues with static routing.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.