NCC hub-and-spoke design: single hybrid spoke receives on‑prem routes via Interconnect in us-east4. VPC spoke must reach on‑prem from us-west1, europe-central1, asia-southeast1 while conserving cloud IP space (192.168.0.0/20). On‑prem network is 172.16.0.0/16. What should you do?

The correct solution addresses the need for resources in multiple regions to access on-premises resources while conserving cloud IP space. Private NAT allows instances in the spoke VPC to use a smaller set of NAT IP addresses (192.168.x.0/24) when communicating with on-premises. Creating NAT gateways in each region where resources need to initiate connections ensures local NAT processing. The export include policy advertises only these NAT IP ranges to the Network Connectivity Center (NCC) hub, preventing the entire large cloud VPC range (192.168.0.0/20) from being advertised on-premises. Global dynamic routing ensures that traffic from all specified regions can reach the on-premises network via the Interconnect in us-east4. Incorrect options: Using 172.16.x.0/24 for NAT subnets is incorrect because 172.16.0.0/16 is the on-premises network, which would cause IP overlap. Creating a single Private NAT gateway in us-east4 would not allow resources in other regions to use NAT for their outbound connections to on-premises; NAT is regional. An export exclude policy would advertise all routes except the specified ones, which is the opposite of the requirement to advertise only the NAT subnets.