Design a high-availability Cloud VPN to a remote site requiring dynamic routing, a shared address space (10.19.0.1/22), and no tunnel overprovisioning on failover. Which configuration follows Google recommended practices?

The correct option uses a custom mode VPC network, Cloud Router BGP, and active/passive routing. A custom mode VPC network is necessary for precise IP address range control, which is required given the shared address space constraint. Cloud Router with BGP provides dynamic routing, essential for high availability and automatic route updates, and is a Google recommended practice for Cloud VPN. Active/passive routing ensures no tunnel overprovisioning on failover, as only one tunnel is actively carrying traffic at a time, with the other as a standby. Incorrect options: Static routes do not provide dynamic routing, failing the requirement. An automatic mode VPC network creates predefined subnets that may conflict with the shared address space. Active/active routing would overprovision tunnels during failover, as both tunnels would be active, potentially leading to traffic imbalance or dropped packets during a switch. Policy-based routing is not the primary mechanism for dynamic route exchange in this scenario.