Quick Answer
The answer is both IPsec IKEv1 and IKEv2, as Cloud VPN explicitly supports both protocols for securing data in transit between on-premises networks and Google Cloud. These protocols establish encrypted tunnels by negotiating security associations, with IKEv1 being the original standard and IKEv2 offering enhanced stability, faster rekeying, and better support for mobile endpoints. On the Google Professional Cloud Security Engineer exam, this concept tests your understanding of how Cloud VPN protects data in transit, often appearing in scenario-based questions where you must identify supported encryption methods. A common trap is assuming only IKEv2 is valid because it is newer, but Google Cloud VPN supports both, so never eliminate IKEv1 as an option. Remember the mnemonic “Both IKEs are OK” to recall that IKEv1 and IKEv2 are equally valid for Cloud VPN tunnels.
This PCSE practice question tests your understanding of ensuring data protection. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are valid methods to protect data in transit between on-premises and Google Cloud using Cloud VPN?
Use Cloud VPN with SSL VPN.
Why wrong: Cloud VPN uses IPsec, not SSL VPN.
Use Cloud VPN with IPsec IKEv2.
Cloud VPN supports IPsec with IKEv2.
Use Cloud NAT for outbound traffic.
Why wrong: Cloud NAT is not a VPN solution.
Use Cloud VPN with IPsec IKEv1.
Cloud VPN supports IKEv1 as a valid option.
Use Cloud Interconnect with MACsec.
Why wrong: MACsec is for Cloud Interconnect, not Cloud VPN.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Use Cloud VPN with IPsec IKEv2.
Cloud VPN supports both IPsec IKEv1 and IKEv2 as valid protocols for establishing secure tunnels between on-premises networks and Google Cloud. IKEv2 offers improved stability and mobility support, but both are explicitly supported by Google Cloud VPN for protecting data in transit.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Use Cloud VPN with SSL VPN.
Use Cloud VPN with IPsec IKEv2.
Use Cloud NAT for outbound traffic.
Use Cloud VPN with IPsec IKEv1.
Why this is correct
Cloud VPN supports IKEv1 as a valid option.
Related concept
Read the scenario before looking for a memorised answer.
Use Cloud Interconnect with MACsec.
Why it's wrong here
MACsec is for Cloud Interconnect, not Cloud VPN.
Common exam traps
Google Cloud often tests the distinction between Cloud VPN (which uses IPsec with IKEv1 or IKEv2) and other connectivity options like Cloud Interconnect or SSL VPN, leading candidates to mistakenly select SSL VPN or MACsec as valid Cloud VPN methods.
Detailed technical explanation
IPsec operates at the network layer (Layer 3) and uses IKE to negotiate security associations (SAs) for encrypting and authenticating packets. IKEv2 (RFC 7296) improves upon IKEv1 by reducing latency during rekeying and supporting MOBIKE for roaming, making it more resilient in dynamic network environments. Cloud VPN supports both IKEv1 and IKEv2, but IKEv2 is recommended for production deployments due to its enhanced reliability.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Ensuring data protection — study guide chapter
Learn the concepts, then practise the questions
Ensuring data protection practice questions
Targeted practice on this topic area only
All PCSE questions
500 questions across all exam domains
Google Professional Cloud Security Engineer study guide
Full concept coverage aligned to exam objectives
PCSE practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise PCSE questions linked to Configuring network security.
Practise PCSE questions linked to Configuring access within a cloud solution environment.
Practise PCSE questions linked to Ensuring data protection.
Practise PCSE questions linked to Managing operations in a cloud solution environment.
Practise PCSE questions linked to Supporting compliance requirements.
Practise PCSE questions linked to PCSE fundamentals.
Practise PCSE questions linked to PCSE scenario.
Practise PCSE questions linked to PCSE troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Ensuring data protection — This question tests Ensuring data protection — Read the scenario before looking for a memorised answer..
The correct answer is: Use Cloud VPN with IPsec IKEv2. — Cloud VPN supports both IPsec IKEv1 and IKEv2 as valid protocols for establishing secure tunnels between on-premises networks and Google Cloud. IKEv2 offers improved stability and mobility support, but both are explicitly supported by Google Cloud VPN for protecting data in transit.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.