Quick Answer
The answer is the Cloud VPN gateway, Peer VPN gateway, and an IPsec tunnel. These three components are required to set up a private connection between an on-premises network and a VPC using Cloud VPN because the Cloud VPN gateway resides in Google Cloud to terminate the connection, the Peer VPN gateway represents the on-premises VPN device with its public IP address, and the IPsec tunnel encrypts all traffic flowing between them. On the Google Professional Cloud Architect exam, this tests your understanding of the fundamental building blocks for hybrid connectivity, often appearing as a multi-select question where a common trap is including the Cloud Router as a required component—it is optional for dynamic routing but not mandatory for the tunnel itself. Remember the mnemonic “Two Gates and a Tunnel” to recall that a Cloud VPN gateway, a Peer VPN gateway, and an IPsec tunnel are the three non-negotiable elements for any site-to-site VPN private connection.
This PCA practice question tests your understanding of manage and provision cloud infrastructure. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE components are required to set up a private connection between an on-premises network and a VPC using Cloud VPN? (Choose three.)
Peer VPN gateway (on-premises).
Required to terminate VPN on-premises.
Two VPN tunnels (for redundancy).
Best practice to have two tunnels for redundancy.
Cloud VPN gateway.
Required to terminate VPN tunnels on Google side.
VPC Network Peering.
Why wrong: Not used for VPN connections.
Cloud Router.
Why wrong: Optional; needed for BGP dynamic routing, not required for static routes.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Peer VPN gateway (on-premises).
Option A is correct because a Peer VPN gateway represents the on-premises VPN device that terminates the IPsec tunnel from the Cloud VPN gateway. This is a required component to establish the encrypted tunnel between your on-premises network and the VPC, as it defines the public IP address and configuration of the remote endpoint.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Peer VPN gateway (on-premises).
Why this is correct
Required to terminate VPN on-premises.
Related concept
Read the scenario before looking for a memorised answer.
Two VPN tunnels (for redundancy).
Why this is correct
Best practice to have two tunnels for redundancy.
Related concept
Read the scenario before looking for a memorised answer.
Cloud VPN gateway.
Why this is correct
Required to terminate VPN tunnels on Google side.
Related concept
Read the scenario before looking for a memorised answer.
VPC Network Peering.
Why it's wrong here
Not used for VPN connections.
Cloud Router.
Why it's wrong here
Optional; needed for BGP dynamic routing, not required for static routes.
Common exam traps
Google Cloud often tests the misconception that Cloud Router is always required for Cloud VPN, but it is only needed for dynamic BGP routing; for static routes, Cloud Router is not a mandatory component.
Detailed technical explanation
Cloud VPN uses IPsec with IKEv1 or IKEv2 to create encrypted tunnels. The three mandatory components are the Cloud VPN gateway (a regional resource with a public IP), the peer VPN gateway (the on-premises device's public IP), and at least one VPN tunnel (two tunnels are recommended for high availability). Under the hood, the tunnel encapsulates traffic using ESP (Encapsulating Security Payload) and requires matching pre-shared keys or certificates for authentication.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Manage and provision cloud infrastructure — study guide chapter
Learn the concepts, then practise the questions
Manage and provision cloud infrastructure practice questions
Targeted practice on this topic area only
All PCA questions
509 questions across all exam domains
Google Professional Cloud Architect study guide
Full concept coverage aligned to exam objectives
PCA practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise PCA questions linked to Design and plan a cloud solution architecture.
Practise PCA questions linked to Manage and provision cloud infrastructure.
Practise PCA questions linked to Design for security and compliance.
Practise PCA questions linked to Analyze and optimize technical and business processes.
Practise PCA questions linked to Manage implementation of cloud architecture.
Practise PCA questions linked to Ensure solution and operations reliability.
Practise PCA questions linked to PCA fundamentals.
Practise PCA questions linked to PCA scenario.
Practise PCA questions linked to PCA troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Manage and provision cloud infrastructure — This question tests Manage and provision cloud infrastructure — Read the scenario before looking for a memorised answer..
The correct answer is: Peer VPN gateway (on-premises). — Option A is correct because a Peer VPN gateway represents the on-premises VPN device that terminates the IPsec tunnel from the Cloud VPN gateway. This is a required component to establish the encrypted tunnel between your on-premises network and the VPC, as it defines the public IP address and configuration of the remote endpoint.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.