Three Key Factors for Designing High Availability Cloud VPN
Which THREE factors should be considered when designing a Cloud VPN for high availability? (Choose 3.)
Quick Answer
The answer is enabling BGP for dynamic routing, using two tunnels from each VPN gateway, and configuring each tunnel to connect to a separate Cloud Router. BGP is essential because it allows the Cloud VPN to automatically detect path failures and reroute traffic between tunnels without manual intervention, unlike static routes which cannot adapt to network changes. On the Google Professional Cloud Network Engineer exam, this question tests your understanding of high availability design principles for hybrid connectivity, often appearing as a multi-select scenario where static routing is a common trap. A key memory tip is to think of BGP as the “brain” that enables failover and load balancing across your two tunnels, while the dual-tunnel and dual-Cloud Router setup provides physical redundancy. Remember the mnemonic “Two Tunnels, Two Routers, One BGP” to recall the three factors quickly.
⚠ Common exam trap
Watch out — candidates often think static routes with a higher metric can provide failover, but they fail to realize that static routes cannot dynamically detect a tunnel failure unless combined with a health check mechanism, which is not as reliable or fast as BGP's built-in path selection and withdrawal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable BGP for dynamic routing
Enabling BGP (Border Gateway Protocol) for dynamic routing is correct because it allows the Cloud VPN to automatically detect and route around failures. BGP exchanges route information between the on-premises router and the Cloud Router, enabling dynamic failover and load balancing across multiple tunnels. Without BGP, you would rely on static routes, which cannot adapt to network changes and require manual intervention during a failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable BGP for dynamic routing
Why this is correct
BGP allows automatic route advertisement and failover.
- ✓
Deploy VPN gateways in different regions
Why this is correct
Provides resilience against regional outages.
- ✓
Use two tunnels from each VPN gateway
Why this is correct
Each gateway should have two tunnels to different on-premises endpoints for redundancy.
- ✗
Use static routes for failover
Why it's wrong here
Static routes do not automatically failover; BGP is required for HA.
- ✗
Use a single Cloud Router for simplicity
Why it's wrong here
A single Cloud Router creates a single point of failure.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to connect on-premise to GCP via Cloud VPN with dynamic routing. They have two on-prem routers for redundancy. Which configuration ensures automatic failover?
easy- A.Create two VPN tunnels each with static routes pointing to the other router
- B.Create one VPN tunnel with BGP and two interfaces
- ✓ C.Create two VPN tunnels using Cloud Router with BGP and the same ASN
- D.Create two VPN tunnels with BGP but different ASNs on each tunnel
Why C: Creating two VPN tunnels with Cloud Router using BGP and the same ASN on both on-prem routers enables dynamic routing and automatic failover. Cloud Router establishes BGP sessions with each on-prem router, and when both tunnels advertise the same routes with the same ASN, Cloud Router can detect a BGP session failure and automatically route traffic through the remaining healthy tunnel. This setup ensures seamless failover without manual intervention.
Variation 2. A company plans to connect an on-premises network to Google Cloud using HA VPN with dynamic routing (BGP). The on-premises side supports BGP and has two independent routers for redundancy. The company wants to ensure failover within seconds if one tunnel goes down. Which configuration meets this requirement?
medium- ✓ A.Create two Cloud VPN gateways in different regions, each with a tunnel to a different on-premises router, and configure a separate Cloud Router on each gateway with BGP.
- B.Create two VPN tunnels from one Cloud VPN gateway to both on-premises routers, and configure one Cloud Router with active/passive BGP.
- C.Create two Cloud VPN gateways in the same region, each with a tunnel to a different on-premises router, and use static routing with route metrics for failover.
- D.Create two VPN tunnels from one Cloud VPN gateway to both on-premises routers, and configure a single Cloud Router with BGP.
Why A: Deploying two Cloud VPN gateways in different regions with separate Cloud Routers ensures true regional redundancy. If one gateway or its tunnel fails, BGP sessions on the other gateway remain active, and Google Cloud's network can immediately route traffic via the surviving path. This architecture meets the sub-second failover requirement by avoiding a single point of failure at the gateway level and leveraging BGP's fast convergence.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.