GCP Associate Cloud Engineer Practice Question

Your company's VPC network is named prod-vpc. All VM instances that should use the on-premises connection have the network tag priv-egress. The on-premises CIDR block is 10.50.0.0/16 and is reachable through an existing Cloud VPN tunnel called corp-tunnel in region us-central1. You need to ensure that traffic from tagged VMs to 10.50.0.0/16 takes this VPN path and not the default internet route. Which gcloud command meets the requirement?

gcloud compute routes create corp-onprem-route --network prod-vpc --destination-range 10.50.0.0/16 --next-hop-vpn-tunnel corp-tunnel --priority 1100 --tags priv-egress
gcloud compute routes create corp-onprem-route --network prod-vpc --destination-range 10.50.0.0/16 --next-hop-instance nat-gce --next-hop-zone us-central1-a --priority 900
gcloud compute routes create corp-onprem-route --network prod-vpc --destination-range 10.50.0.0/16 --next-hop-gateway default-internet-gateway --priority 900 --tags priv-egress
gcloud compute routes create corp-onprem-route --network prod-vpc --destination-range 10.50.0.0/16 --next-hop-vpn-tunnel corp-tunnel --next-hop-vpn-tunnel-region us-central1 --priority 900 --tags priv-egress

Report Issue

Answer Description

A custom static route must specify the destination range, the VPC network, and the appropriate next hop. When the next hop is a Cloud VPN tunnel you must include both --next-hop-vpn-tunnel and --next-hop-vpn-tunnel-region. Because the system-generated default route has priority 1000, giving the custom route a lower number such as 900 guarantees it is preferred. Adding the --tags flag limits the route to packets originating from VMs that have the priv-egress tag. The correct command therefore uses the VPN tunnel as the next hop, includes the region, sets priority 900, and applies the priv-egress tag. The other options either point to the internet gateway, omit the required region flag, have a lower preference than the default route, or choose the wrong next-hop type.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.