PCNE Implementing a Virtual Private Cloud Practice Question
A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?
⚠ Common exam trap
Many exam-takers assume Dedicated Interconnect is always superior for high availability, but the question explicitly requires IPsec VPN, and Interconnect does not support IPsec VPN, making it an invalid choice despite its high availability features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.
Deploying two Cloud VPN tunnels from two Cloud Routers with BGP sessions provides high availability and automatic failover. The two Cloud Routers in different zones ensure redundancy, and BGP (Border Gateway Protocol) dynamically advertises routes and detects tunnel failures, allowing traffic to automatically switch to the healthy tunnel without manual intervention. This meets the requirement for an IPsec VPN connection to a third-party SaaS provider that only supports IPsec VPN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.
Why this is correct
This provides HA with automatic failover via BGP; Cloud Routers enable dynamic routing and fast convergence.
- ✗
Use Dedicated Interconnect with VLAN attachments to the SaaS provider.
Why it's wrong here
Dedicated Interconnect is a direct physical connection, not IPsec VPN, and may not be supported by the SaaS provider.
- ✗
Deploy a Classic VPN tunnel with policy-based routing.
Why it's wrong here
Classic VPN does not support BGP dynamic routing, so failover is not automatic.
- ✗
Deploy a single Cloud VPN tunnel and use static routing.
Why it's wrong here
Static routing does not support automatic failover; single tunnel is a single point of failure.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.