CLF-C02 Cloud Technology and Services Practice Question
A company runs multiple workloads in separate Amazon VPCs within the same AWS Region. The networking team needs to enable connectivity between all VPCs using private IP addresses. Additionally, the team must connect all VPCs to the company's on-premises data center through a single AWS Site-to-Site VPN connection to minimize costs and simplify management. The solution must support transitive routing so that any VPC can communicate with any other VPC and with the on-premises network. Which AWS service should the networking team use to meet these requirements?
⚠ Common exam trap
Many candidates confuse VPC Peering with transitive routing, assuming that multiple peering connections can forward traffic between VPCs, but AWS explicitly does not support transitive routing through VPC peering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Transit Gateway with VPN attachments
AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks through a single VPN attachment, supporting transitive routing between all connected networks. This meets the requirements for private IP connectivity, cost minimization, and simplified management by avoiding the need for full-mesh VPC peering or multiple VPN connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Peering with a VPN attachment to a Virtual Private Gateway
Why it's wrong here
VPC Peering does not support transitive routing; each VPC would need a separate peering connection to every other VPC, and a VPN attachment to a Virtual Private Gateway connects only that single VPC to the on-premises network. This solution does not provide transitive connectivity between all VPCs and the on-premises data center through a single VPN connection.
When this WOULD be correct
If the requirement was to connect only two VPCs to an on-premises network via a single VPN, and transitive routing was not needed, VPC Peering with a VPN attachment to a Virtual Private Gateway could be used.
- ✓
AWS Transit Gateway with VPN attachments
Why this is correct
Correct. AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs and VPN connections. By attaching a single Site-to-Site VPN to the Transit Gateway, all VPCs can communicate with each other and with the on-premises network using private IP addresses, simplifying management and reducing costs.
- ✗
AWS Direct Connect gateway with VPC associations
Why it's wrong here
AWS Direct Connect gateway is used to associate a Direct Connect dedicated connection with multiple VPCs, but it does not provide transitive routing between VPCs by itself. It also does not support Site-to-Site VPN connections as the primary method; Direct Connect is a dedicated physical connection, not a VPN.
When this WOULD be correct
A company needs to connect multiple VPCs to an on-premises data center via AWS Direct Connect, and does not require VPC-to-VPC connectivity or transitive routing. The Direct Connect gateway would centralize the connection.
- ✗
A Network Load Balancer with VPN endpoints
Why it's wrong here
A Network Load Balancer is designed to distribute incoming traffic across targets, not to interconnect VPCs or to provide VPN connectivity. It does not support routing between VPCs or transcending VPC boundaries in the manner required.
When this WOULD be correct
A Network Load Balancer with VPN endpoints would be correct if the requirement was to load balance incoming VPN traffic from multiple on-premises locations to a set of backend instances in a single VPC, without needing inter-VPC connectivity or transitive routing.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Transit Gateway with VPN attachmentsCorrect answer▾
Why this is correct
Correct. AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs and VPN connections. By attaching a single Site-to-Site VPN to the Transit Gateway, all VPCs can communicate with each other and with the on-premises network using private IP addresses, simplifying management and reducing costs.
✗VPC Peering with a VPN attachment to a Virtual Private GatewayWrong answer — click to see why▾
Why this is wrong here
VPC Peering does not support transitive routing, so it cannot enable communication between all VPCs through a single VPN connection; each VPC would need its own VPN attachment to the Virtual Private Gateway.
★ When this WOULD be the correct answer
If the requirement was to connect only two VPCs to an on-premises network via a single VPN, and transitive routing was not needed, VPC Peering with a VPN attachment to a Virtual Private Gateway could be used.
Why candidates choose this
Candidates may confuse VPC Peering's ability to connect VPCs with the need for transitive routing, or assume that a Virtual Private Gateway can aggregate multiple VPCs like a Transit Gateway.
✗AWS Direct Connect gateway with VPC associationsWrong answer — click to see why▾
Why this is wrong here
AWS Direct Connect gateway does not support transitive routing between VPCs; it only connects VPCs to Direct Connect, not to each other or to a Site-to-Site VPN.
★ When this WOULD be the correct answer
A company needs to connect multiple VPCs to an on-premises data center via AWS Direct Connect, and does not require VPC-to-VPC connectivity or transitive routing. The Direct Connect gateway would centralize the connection.
Why candidates choose this
Candidates may confuse Direct Connect gateway with Transit Gateway, thinking it can also provide transitive routing, or they may focus on the on-premises connection and overlook the VPC-to-VPC requirement.
✗A Network Load Balancer with VPN endpointsWrong answer — click to see why▾
Why this is wrong here
A Network Load Balancer (NLB) with VPN endpoints does not provide transitive routing between VPCs or connect multiple VPCs to an on-premises network via a single VPN connection. NLB distributes traffic to targets within a single VPC and cannot route traffic between separate VPCs or act as a central hub for VPN connectivity.
★ When this WOULD be the correct answer
A Network Load Balancer with VPN endpoints would be correct if the requirement was to load balance incoming VPN traffic from multiple on-premises locations to a set of backend instances in a single VPC, without needing inter-VPC connectivity or transitive routing.
Why candidates choose this
Candidates may confuse the term 'VPN endpoints' with VPN connections and think an NLB can handle VPN termination and routing, overlooking that NLB operates at Layer 4 and lacks the routing capabilities needed for transitive VPC-to-VPC and VPC-to-on-premises connectivity.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.