nerdexam
Google

PROFESSIONAL-CLOUD-NETWORK-ENGINEER · Question #176

You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible. To ease the transition, you decided to use the same…

The correct answer is C. Connect all the spokes to the hub with Cloud VPN. Use a third-party network appliance as a. To implement a hub-and-spoke model for over 50 spokes with no direct spoke-to-spoke connectivity, minimizing management overhead, cost, and adhering to default quotas, Cloud VPNs with a central third-party network appliance in the hub is the appropriate solution.

Submitted by saadiq_pk· Apr 18, 2026Designing, planning, and prototyping a Google Cloud network

Question

You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible. To ease the transition, you decided to use the same architecture as your on-premises network: a hub-and-spoke model. Your on-premises architecture consists of over 50 spokes. Each spoke does not have connectivity to the other spokes, and all traffic is sent through the hub for security reasons. You need to ensure that the Google Cloud architecture matches your on-premises architecture. You want to implement a solution that minimizes management overhead and cost, and uses default networking quotas and limits. What should you do?

Options

  • AConnect all the spokes to the hub with Cloud VPN.
  • BConnect all the spokes to the hub with VPC Network Peering.
  • CConnect all the spokes to the hub with Cloud VPN. Use a third-party network appliance as a
  • DConnect all the spokes to the hub with VPC Network Peering. Use a third-party network appliance

How the community answered

(21 responses)
  • A
    10% (2)
  • B
    24% (5)
  • C
    62% (13)
  • D
    5% (1)

Why each option

To implement a hub-and-spoke model for over 50 spokes with no direct spoke-to-spoke connectivity, minimizing management overhead, cost, and adhering to default quotas, Cloud VPNs with a central third-party network appliance in the hub is the appropriate solution.

AConnect all the spokes to the hub with Cloud VPN.

While Cloud VPN can connect spokes, it doesn't inherently enforce the "no spoke-to-spoke" requirement without a central security appliance, which is critical for the stated security reasons.

BConnect all the spokes to the hub with VPC Network Peering.

VPC Network Peering is limited to 25 peering connections per VPC, making it unsuitable for an architecture with over 50 spokes based on default quotas.

CConnect all the spokes to the hub with Cloud VPN. Use a third-party network appliance as aCorrect

Cloud VPN allows connecting more than 50 spokes to a hub, unlike VPC Network Peering which is limited to 25 peering connections per VPC, and a third-party network appliance in the hub provides the necessary centralized traffic inspection and enforcement to prevent spoke-to-spoke communication for security reasons.

DConnect all the spokes to the hub with VPC Network Peering. Use a third-party network appliance

VPC Network Peering's limit of 25 peering connections per VPC makes it impossible to connect over 50 spokes to a single hub without exceeding default quotas.

Concept tested: Hub-and-spoke scaling with VPN and security appliance

Source: https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#hub-and-spoke-model

Topics

#Hub-and-spoke network#Cloud VPN#Third-party network appliance#VPC Peering limitations

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice