← CLF-C02·Amazon Web Services

Question 107 of 1,024

Cloud Technology and Services →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is AWS Transit Gateway. This service acts as a central hub that connects multiple VPCs and on-premises networks using a single VPN attachment, enabling transitive routing so that any VPC can communicate with any other VPC or the data center over private IPs. By consolidating connectivity into one gateway, it eliminates the need for complex full-mesh VPC peering or multiple VPN connections, directly meeting the requirements for cost minimization and simplified management. On the CLF-C02 exam, this scenario tests your understanding of how Transit Gateway differs from VPC peering, which does not support transitive routing—a common trap where students mistakenly choose peering for multi-VPC setups. Remember the memory tip: Transit Gateway is the “hub-and-spoke” router, while VPC peering is only “point-to-point.”

CLF-C02 Cloud Technology and Services Practice Question

This CLF-C02 practice question tests your understanding of cloud technology and services. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company runs multiple workloads in separate Amazon VPCs within the same AWS Region. The networking team needs to enable connectivity between all VPCs using private IP addresses. Additionally, the team must connect all VPCs to the company's on-premises data center through a single AWS Site-to-Site VPN connection to minimize costs and simplify management. The solution must support transitive routing so that any VPC can communicate with any other VPC and with the on-premises network. Which AWS service should the networking team use to meet these requirements?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "minimum / minimize"
Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.

Question 1mediummultiple choice

Read the full VPN explanation →

A
VPC Peering with a VPN attachment to a Virtual Private Gateway
Why wrong: VPC Peering does not support transitive routing; each VPC would need a separate peering connection to every other VPC, and a VPN attachment to a Virtual Private Gateway connects only that single VPC to the on-premises network. This solution does not provide transitive connectivity between all VPCs and the on-premises data center through a single VPN connection.
B
AWS Transit Gateway with VPN attachments
Correct. AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs and VPN connections. By attaching a single Site-to-Site VPN to the Transit Gateway, all VPCs can communicate with each other and with the on-premises network using private IP addresses, simplifying management and reducing costs.
C
AWS Direct Connect gateway with VPC associations
Why wrong: AWS Direct Connect gateway is used to associate a Direct Connect dedicated connection with multiple VPCs, but it does not provide transitive routing between VPCs by itself. It also does not support Site-to-Site VPN connections as the primary method; Direct Connect is a dedicated physical connection, not a VPN.
D
A Network Load Balancer with VPN endpoints
Why wrong: A Network Load Balancer is designed to distribute incoming traffic across targets, not to interconnect VPCs or to provide VPN connectivity. It does not support routing between VPCs or transcending VPC boundaries in the manner required.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Transit Gateway with VPN attachments

AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks through a single VPN attachment, supporting transitive routing between all connected networks. This meets the requirements for private IP connectivity, cost minimization, and simplified management by avoiding the need for full-mesh VPC peering or multiple VPN connections.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
VPC Peering with a VPN attachment to a Virtual Private Gateway
Why it's wrong here
VPC Peering does not support transitive routing; each VPC would need a separate peering connection to every other VPC, and a VPN attachment to a Virtual Private Gateway connects only that single VPC to the on-premises network. This solution does not provide transitive connectivity between all VPCs and the on-premises data center through a single VPN connection.
✓
AWS Transit Gateway with VPN attachments
Why this is correct
Correct. AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs and VPN connections. By attaching a single Site-to-Site VPN to the Transit Gateway, all VPCs can communicate with each other and with the on-premises network using private IP addresses, simplifying management and reducing costs.
Clue confirmation
The clue word "minimum / minimize" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
AWS Direct Connect gateway with VPC associations
Why it's wrong here
AWS Direct Connect gateway is used to associate a Direct Connect dedicated connection with multiple VPCs, but it does not provide transitive routing between VPCs by itself. It also does not support Site-to-Site VPN connections as the primary method; Direct Connect is a dedicated physical connection, not a VPN.
✗
A Network Load Balancer with VPN endpoints
Why it's wrong here
A Network Load Balancer is designed to distribute incoming traffic across targets, not to interconnect VPCs or to provide VPN connectivity. It does not support routing between VPCs or transcending VPC boundaries in the manner required.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse VPC Peering with transitive routing, assuming that multiple peering connections can forward traffic between VPCs, but AWS explicitly does not support transitive routing through VPC peering.

Detailed technical explanation

How to think about this question

Transit Gateway uses a dynamic routing protocol (BGP) over VPN attachments to exchange routes between VPCs and on-premises networks, enabling any-to-any connectivity without manual route table entries. Under the hood, each VPC attachment is associated with a Transit Gateway route table, and route propagation allows automatic learning of routes from VPN attachments, ensuring transitive routing works seamlessly. In a real-world scenario, this allows a company to add new VPCs or branch offices without reconfiguring existing connections, as long as the Transit Gateway route tables are properly configured.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related CLF-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Cloud Concepts practice questions

Practise CLF-C02 questions linked to Cloud Concepts.

Security and Compliance practice questions

Practise CLF-C02 questions linked to Security and Compliance.

Cloud Technology and Services practice questions

Practise CLF-C02 questions linked to Cloud Technology and Services.

Billing, Pricing, and Support practice questions

Practise CLF-C02 questions linked to Billing, Pricing, and Support.

AWS shared responsibility model practice questions

Practise CLF-C02 questions linked to AWS shared responsibility model.

AWS IAM practice questions

Practise CLF-C02 questions linked to AWS IAM.

AWS pricing practice questions

Practise CLF-C02 questions linked to AWS pricing.

AWS support plans practice questions

Practise CLF-C02 questions linked to AWS support plans.

AWS S3 practice questions

Practise CLF-C02 questions linked to AWS S3.

AWS EC2 practice questions

Practise CLF-C02 questions linked to AWS EC2.

Practice this exam

Start a free CLF-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

CLF-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this CLF-C02 question test?

Cloud Technology and Services — This question tests Cloud Technology and Services — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: AWS Transit Gateway with VPN attachments — AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks through a single VPN attachment, supporting transitive routing between all connected networks. This meets the requirements for private IP connectivity, cost minimization, and simplified management by avoiding the need for full-mesh VPC peering or multiple VPN connections.

What should I do if I get this CLF-C02 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "minimum / minimize". Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.