In a hub-and-spoke VPC architecture, enable on-prem to resolve Cloud DNS private zones and allow spoke VPCs to resolve on-prem zones. What do you implement?

To allow on-premises systems to resolve Cloud DNS private zones, you need to configure DNS forwarding from the hub VPC to your on-premises DNS servers. This is achieved by creating a private DNS zone in the hub VPC and setting up an outbound server policy that points to your on-premises DNS. For spoke VPCs to resolve on-premises zones, they need to be able to query the hub VPC's DNS. This is done by configuring DNS peering from each spoke VPC to the hub VPC. This setup centralizes DNS resolution for both directions through the hub, which is a common practice in hub-and-spoke architectures. Incorrect options propose incorrect configurations for DNS policies, private zone locations, or peering directions that would not achieve the bidirectional resolution requirements. For example, creating private zones in spokes and peering them to the hub doesn't centralize on-prem resolution effectively.