CLF-C02 Cloud Technology and Services Practice Question
A company needs to connect multiple VPCs and on-premises networks through a single hub, simplifying network management. Which AWS service acts as a cloud router to interconnect these networks?
⚠ Common exam trap
Watch out — candidates often confuse VPC Peering (which is free but non-transitive and requires full mesh) with Transit Gateway (which provides transitive routing and central management), leading them to choose VPC Peering for multi-VPC connectivity without considering the hub-and-spoke requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Transit Gateway
AWS Transit Gateway acts as a cloud router, using a hub-and-spoke model to interconnect multiple VPCs and on-premises networks through a single gateway. It simplifies network management by centralizing routing, supporting transitive routing between all attached networks, and integrating with AWS Direct Connect and VPN connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Peering
Why it's wrong here
VPC Peering creates a direct, one-to-one network connection between exactly two VPCs. It does not support transitive routing, so connecting 10 VPCs in a full mesh requires 45 separate peering connections, each with its own route table entries. Any-to-any connectivity at scale therefore becomes operationally complex and error-prone, especially as peering does not allow overlapping CIDR blocks.
- ✓
AWS Transit Gateway
Why this is correct
AWS Transit Gateway is a fully managed cloud router that provides hub-and-spoke connectivity between VPCs and on-premises networks. A single Transit Gateway attachment per VPC enables transitive routing, so 10 VPCs need only 10 attachments rather than 45 peering connections. Route tables within the Transit Gateway control which attachments can communicate, and it also supports VPN and Direct Connect attachments for hybrid network integration.
- ✗
AWS Direct Connect
Why it's wrong here
AWS Direct Connect is a dedicated physical network connection from your on-premises data center to AWS. While it provides low-latency, private connectivity for hybrid workloads, it does not create paths between VPCs. Connecting multiple VPCs through Direct Connect still requires an intermediary such as a Transit Gateway or VPC peering; by itself it simply terminates at a virtual interface, not at a VPC-to-VPC router.
- ✗
Internet Gateway
Why it's wrong here
An Internet Gateway is a horizontally scaled, redundant component that enables VPC resources to communicate with the public internet. It provides a target for IPv4 public traffic and performs NAT for instances with public IPs, but it has no capability to route traffic between VPCs or to on-premises networks. It is not a router for private network paths; its only role is bridging a VPC to the internet.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.