nerdexam
Fortinet

NSE4 · Question #305

You are tasked to architect a new IPsec deployment with the following criteria: - There are two HQ sites that all satellite offices must connect to. - The satellite offices do not need to…

The correct answer is B. Hub-and-spoke. A hub-and-spoke IPsec topology is ideal when satellite offices need to connect to central HQ sites but not communicate directly with each other, while minimizing tunnel configuration.

Submitted by kim_seoul· Apr 18, 2026VPN and Routing

Question

You are tasked to architect a new IPsec deployment with the following criteria:

  • There are two HQ sites that all satellite offices must connect to.
  • The satellite offices do not need to communicate directly with other

satellite offices.

  • No dynamic routing will be used.
  • The design should minimize the number of tunnels being configured.

Which topology should be used to satisfy all of the requirements?

Options

  • ARedundant
  • BHub-and-spoke
  • CPartial mesh
  • DFully meshed

How the community answered

(46 responses)
  • A
    2% (1)
  • B
    80% (37)
  • C
    7% (3)
  • D
    11% (5)

Why each option

A hub-and-spoke IPsec topology is ideal when satellite offices need to connect to central HQ sites but not communicate directly with each other, while minimizing tunnel configuration.

ARedundant

Redundant is a characteristic of a design (e.g., redundant links or hubs) rather than a primary network topology that defines how all sites connect and communicate.

BHub-and-spokeCorrect

A hub-and-spoke topology allows all satellite offices (spokes) to connect to central HQ sites (hubs) without requiring direct connections between spokes, thereby satisfying the requirement for no direct satellite-to-satellite communication and minimizing tunnel count.

CPartial mesh

A partial mesh topology would involve some satellite offices connecting directly to each other, violating the requirement that satellite offices do not need to communicate with one another.

DFully meshed

A fully meshed topology would require every site to have a tunnel to every other site, resulting in a significantly higher number of tunnels and enabling direct satellite-to-satellite communication, which is explicitly not required.

Concept tested: IPsec VPN topology selection (Hub-and-spoke)

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/501308/ipsec-vpn-topologies

Topics

#IPsec VPN#VPN Topologies#Hub-and-Spoke#Network Design

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice