Your on-prem VPN device supports only IKEv2 and not BGP. To minimize downtime and operational overhead as your network grows, what Cloud VPN configuration should you use?

The correct option describes a policy-based VPN, which is necessary when the on-premise device does not support BGP for dynamic routing. Policy-based VPNs rely on traffic selectors to define which traffic should be encrypted and sent over the tunnel. These selectors must explicitly match the local and remote networks. Static routes are then configured to direct traffic over the VPN tunnel. The first incorrect option suggests creating a tunnel per subnet, which is unnecessary and increases operational overhead. A single policy-based tunnel can handle multiple subnets if the traffic selectors are configured correctly. The third and fourth options are incorrect because they propose a route-based VPN. Route-based VPNs typically use BGP for dynamic routing, which is not supported by the on-premise device in this scenario. While route-based VPNs can sometimes use static routes, policy-based is the more direct and appropriate solution when BGP is unavailable and specific traffic selectors are needed.