PCNE Implementing Hybrid Interconnectivity Practice Question
A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?
⚠ Common exam trap
Test-takers frequently assume HA VPN always requires static peer IPs, but the Google Cloud PCNE exam tests the nuance that HA VPN with a single gateway (and dynamic peer IP support) is the correct choice when the remote peer has a dynamic public IP, not the dual-gateway HA configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HA VPN with a single VPN gateway and a dynamic peer IP
HA VPN supports dynamic peer IP addresses through its use of IKEv2 and route-based VPN tunnels. When the branch office has a dynamic public IP, HA VPN can establish tunnels using the peer's current IP address, which is discovered during IKE negotiation. Classic VPN (option A) requires a static peer IP, and option D requires two static peer IPs, making them unsuitable for a dynamic IP scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Classic VPN with a static IP on the peer
Why it's wrong here
Classic VPN requires a static peer IP; dynamic IP would cause the tunnel to fail after IP changes.
- ✗
A custom SSL VPN appliance on Compute Engine
Why it's wrong here
SSL VPN is not a native Cloud VPN service and adds complexity.
- ✓
HA VPN with a single VPN gateway and a dynamic peer IP
Why this is correct
HA VPN supports dynamic peer IP addresses, making it suitable for branches with dynamic IPs.
- ✗
HA VPN with two VPN gateways and static peer IPs
Why it's wrong here
HA VPN supports dynamic peer IPs; two gateways are not required for a branch.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.