nerdexam
Fortinet

NSE4 · Question #238

What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully- meshed set of IPSec tunnels? (Select all that apply.)

The correct answer is B. Using a hub and spoke topology simplifies configuration. D. Using a hub and spoke topology reduces the number of tunnels. Hub-and-spoke IPSec VPN simplifies configuration and reduces the total number of tunnels compared to a fully-meshed topology.

Submitted by the_admin· Apr 18, 2026VPN and Routing

Question

What advantages are there in using a hub-and-spoke IPSec VPN configuration instead of a fully- meshed set of IPSec tunnels? (Select all that apply.)

Options

  • AUsing a hub and spoke topology is required to achieve full redundancy.
  • BUsing a hub and spoke topology simplifies configuration.
  • CUsing a hub and spoke topology provides stronger encryption.
  • DUsing a hub and spoke topology reduces the number of tunnels.

How the community answered

(63 responses)
  • A
    3% (2)
  • B
    95% (60)
  • C
    2% (1)

Why each option

Hub-and-spoke IPSec VPN simplifies configuration and reduces the total number of tunnels compared to a fully-meshed topology.

AUsing a hub and spoke topology is required to achieve full redundancy.

Full redundancy is often more directly achieved with a full-mesh topology, or requires additional redundant hubs in a hub-and-spoke setup, making it not inherently simpler or required for full redundancy.

BUsing a hub and spoke topology simplifies configuration.Correct

A hub-and-spoke topology significantly simplifies VPN configuration because each spoke site only needs to establish a single tunnel to the central hub, rather than a tunnel to every other site.

CUsing a hub and spoke topology provides stronger encryption.

The choice of VPN topology (hub-and-spoke vs. full-mesh) does not impact the strength of the encryption algorithms used; encryption strength is determined by the configured cipher suites and key lengths.

DUsing a hub and spoke topology reduces the number of tunnels.Correct

For N sites, a hub-and-spoke topology requires N-1 tunnels (one from each spoke to the hub), which is a much lower number compared to the N*(N-1)/2 tunnels required for a full-mesh topology.

Concept tested: VPN topology comparison (Hub-and-Spoke vs. Full Mesh)

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/963009/ipsec-vpn-to-multiple-spokes

Topics

#IPSec VPN#VPN Topologies#Hub-and-Spoke#Full Mesh

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice