Question 23

Question

You are designing a hub-and-spoke network architecture for your company’s cloud-based
environment. You need to make sure that all spokes are peered with the hub. The spokes must use
the hub's virtual appliance for internet access.
The virtual appliance is configured in high-availability mode with two instances using an internal load
balancer with IP address 10.0.0.5. What should you do?

Accepted Answer

Create a default route in the hub VPC that points to IP address 10.0.0.5.
Delete the default internet gateway route in the hub VPC, and create a new higher-priority route that
is tagged only to the appliances with a next hop of the default internet gateway.
Export the custom routes in the hub. Import the custom routes in the spokes.
Delete the default internet gateway route of the spokes.

Zoe B. · Answer

Looks like B is the best fit here. Exporting custom routes from the hub and importing into the spokes, plus removing each spoke's default IGW route, makes sure all internet-bound traffic hits 10.0.0.5 in the hub. That's what you want for this forced-tunnel design I think, but happy to see another take if someone disagrees.

Sara · Answer

I don’t think it’s C. Only B removes the spokes’ default IGW route so their internet-bound traffic has to go through the hub's appliance at 10.0.0.5, which is what’s needed here. C is a common trap since it misses that step and would let spokes bypass the hub. Seen similar in practice exams. Anyone disagree?

MethodicalMentor3283 · Answer

B not A

JackW · Answer

B makes sense here. You have to delete the spokes’ default internet gateway route so all internet-bound traffic from the spokes is forced through the hub's appliance (10.0.0.5). Just exporting/importing routes isn't enough by itself. Pretty sure that’s what Google wants with this setup, but curious if anyone's made it work another way.

Avery M. · Answer

Does anyone know if deleting the spoke's default internet gateway route is always necessary in these designs, or can you just rely on custom route import/export? I've seen guidance about exporting custom routes from hub and importing to spokes, but wasn't sure if both steps are essential. Maybe there's a subtle difference here?

Google Professional Cloud Network Engineer Real Exam Questions [October 2026 Update] Quiz

Premium Access Includes