CLF-C02 Cloud Technology and Services Practice Question
A company runs a multi-region application on AWS with separate VPCs in us-east-1 and eu-west-1. The company also has an on-premises data center connected to AWS via AWS Direct Connect. The network team wants to simplify the routing topology so that traffic between all VPCs and the on-premises network flows through a central hub. They need a service that can manage many VPC attachments and provide transitive routing across all connected networks. Which AWS service should the network team use?
⚠ Common exam trap
Watch out — candidates often confuse AWS Direct Connect Gateway with Transit Gateway, assuming Direct Connect Gateway can provide transitive routing between VPCs, but it only connects Direct Connect circuits to multiple VPCs and does not enable VPC-to-VPC routing or act as a central hub for all network attachments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Transit Gateway
AWS Transit Gateway is the correct choice because it acts as a central hub that connects multiple VPCs and on-premises networks via a single gateway, enabling transitive routing between all attached networks. It supports many VPC attachments (up to thousands per gateway) and simplifies routing topology by eliminating the need for complex peering or VPN mesh configurations. This directly meets the requirement for a service that manages many VPC attachments and provides transitive routing across all connected networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Transit Gateway
Why this is correct
AWS Transit Gateway is a network transit hub that connects VPCs, VPN connections, and AWS Direct Connect connections. It supports transitive routing, allowing all attached networks to communicate through a single gateway, which simplifies network architecture.
- ✗
Amazon Route 53
Why it's wrong here
Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service designed to translate human-readable domain names (e.g., www.example.com) into IP addresses. It operates at the application layer and has no data-plane capability to forward or route network traffic between VPCs or connect on-premises networks to AWS resources. While Route 53 can route end-user DNS queries to appropriate endpoints such as Application Load Balancers or Global Accelerator, it does not provide layer-3/Layer-4 path selection or transitive connectivity between virtual networks, making it unsuitable for the multi-region network interconnection described in the scenario.
When this WOULD be correct
A company wants to route traffic to an on-premises data center using a domain name, and needs DNS resolution to return the correct IP address based on the health and location of endpoints. Route 53 would be the correct answer for a DNS-based traffic management scenario.
- ✗
AWS Direct Connect Gateway
Why it's wrong here
AWS Direct Connect Gateway allows a Direct Connect connection to access VPCs in any AWS Region, but it does not provide transitive routing between those VPCs. For VPC-to-VPC communication, additional components like Transit Gateway or VPC peering are needed.
When this WOULD be correct
A company has multiple VPCs in the same or different regions that need to connect to a single on-premises data center via AWS Direct Connect. The requirement is to simplify the connection of multiple VPCs to the Direct Connect link without needing transitive routing between VPCs.
- ✗
AWS PrivateLink
Why it's wrong here
AWS PrivateLink provides private connectivity between VPCs and AWS services, or between VPCs and on-premises applications, but it does not offer transitive routing across multiple VPCs or act as a central hub for network traffic.
When this WOULD be correct
A company needs to privately access a third-party SaaS application hosted in another AWS account without using public internet, VPC peering, or VPN. AWS PrivateLink would be the correct service to create a VPC endpoint for that service.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Transit GatewayCorrect answer▾
Why this is correct
AWS Transit Gateway is a network transit hub that connects VPCs, VPN connections, and AWS Direct Connect connections. It supports transitive routing, allowing all attached networks to communicate through a single gateway, which simplifies network architecture.
✗Amazon Route 53Wrong answer — click to see why▾
Why this is wrong here
Amazon Route 53 is a DNS service, not a network transit or routing service. It cannot provide transitive routing between VPCs and on-premises networks.
★ When this WOULD be the correct answer
A company wants to route traffic to an on-premises data center using a domain name, and needs DNS resolution to return the correct IP address based on the health and location of endpoints. Route 53 would be the correct answer for a DNS-based traffic management scenario.
Why candidates choose this
Candidates may confuse 'routing' in the context of DNS (routing traffic to endpoints) with network-layer routing, leading them to select Route 53 when the question is about VPC-to-VPC and on-premises connectivity.
✗AWS Direct Connect GatewayWrong answer — click to see why▾
Why this is wrong here
AWS Direct Connect Gateway is used to connect multiple VPCs to a Direct Connect connection, but it does not provide transitive routing between VPCs or between VPCs and on-premises networks across different regions; it only facilitates private connectivity to a single Direct Connect link.
★ When this WOULD be the correct answer
A company has multiple VPCs in the same or different regions that need to connect to a single on-premises data center via AWS Direct Connect. The requirement is to simplify the connection of multiple VPCs to the Direct Connect link without needing transitive routing between VPCs.
Why candidates choose this
Candidates may confuse Direct Connect Gateway with Transit Gateway because both can connect multiple VPCs to on-premises networks, but they overlook that Direct Connect Gateway lacks transitive routing capabilities between attached networks.
✗AWS PrivateLinkWrong answer — click to see why▾
Why this is wrong here
AWS PrivateLink does not provide transitive routing between VPCs or between VPCs and on-premises networks; it only enables private connectivity to specific services or endpoints within a VPC.
★ When this WOULD be the correct answer
A company needs to privately access a third-party SaaS application hosted in another AWS account without using public internet, VPC peering, or VPN. AWS PrivateLink would be the correct service to create a VPC endpoint for that service.
Why candidates choose this
Candidates may confuse PrivateLink's ability to connect VPCs to services with the need for transitive routing, or they may think it can replace a transit gateway for hub-and-spoke topologies.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.