ANS-C01 Network Design Practice Question
A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?
⚠ Common exam trap
Many candidates confuse VPC peering with transitive routing, assuming that peering multiple VPCs to a central VPC automatically routes traffic through it, but VPC peering does not support transitive routing—each peering connection is non-transitive, so traffic between two spoke VPCs would not go through the central VPC unless explicit routing is configured, which is complex and not natively supported.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Transit Gateway with centralized routing to the inspection VPC.
AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC peering between all VPCs and the inspection VPC.
Why it's wrong here
Peering is direct, doesn't force inspection.
- ✗
AWS Network Firewall deployed in each VPC.
Why it's wrong here
Distributed, not centralized.
- ✓
AWS Transit Gateway with centralized routing to the inspection VPC.
Why this is correct
Centralized routing enforces inspection.
- ✗
AWS Direct Connect Gateway with virtual interfaces.
Why it's wrong here
For on-premises, not inter-VPC.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?
hard- A.Use VPC Peering for all inter-VPC communication
- ✓ B.Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.
- C.Use AWS Site-to-Site VPN between each VPC and a central VPN hub
- ✓ D.Create separate Transit Gateway route tables for production and development environments. For development VPCs, add a static route for 0.0.0.0/0 pointing to a NAT Gateway in a shared services VPC.
- E.Use AWS Client VPN to connect development VPCs to the production VPC
Why B: It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.
Variation 2. A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to establish a central inspection VPC for traffic inspection using a Gateway Load Balancer (GWLB). Traffic from all other VPCs should be routed through the inspection VPC before reaching the internet or on-premises. Which architecture should be used?
hard- A.Use VPC Peering to connect all VPCs to the inspection VPC and configure routes to the GWLB.
- B.Use AWS Direct Connect Gateway to connect all VPCs and route traffic through the inspection VPC.
- ✓ C.Use AWS Transit Gateway with a centralized inspection VPC that hosts a GWLB. Configure route tables on the Transit Gateway to send traffic to the GWLB endpoint.
- D.Use AWS Network Firewall in each VPC and route traffic to it.
Why C: AWS Transit Gateway enables centralized routing between multiple VPCs, and when combined with a Gateway Load Balancer (GWLB) in an inspection VPC, it allows traffic from all other VPCs to be forwarded to the GWLB for inspection before reaching the internet or on-premises. Transit Gateway route tables can be configured with static routes pointing to the GWLB endpoint (using Gateway Load Balancer Endpoint service), ensuring all inter-VPC and egress traffic is steered through the inspection VPC. This architecture scales efficiently across many VPCs in an AWS Organizations multi-account setup without requiring complex peering or direct connections.
Variation 3. A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?
hard- ✓ A.The Transit Gateway route tables allow direct communication between application VPCs
- B.The inspection VPC does not have a subnet for east-west traffic
- C.Network Firewall cannot inspect traffic between VPCs at high throughput
- D.Network Firewall is not stateful and cannot handle return traffic
Why A: The most likely reason east-west traffic is bypassing the Network Firewall is that the Transit Gateway route tables allow direct communication between application VPCs. For traffic to be inspected, it must be routed through the inspection VPC. If the application VPCs have routes in the same Transit Gateway route table that point directly to each other (e.g., a static route or a propagated route from the same VPC attachment), traffic will take that direct path and bypass the Network Firewall. Option B is incorrect because the inspection VPC can have subnets for east-west traffic; the issue is routing, not subnet design. Option C is incorrect because Network Firewall can inspect traffic between VPCs at high throughput. Option D is incorrect because Network Firewall is stateful and handles return traffic correctly.
Variation 4. A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)
hard- A.Create a VPC peering connection between each spoke VPC and the central VPC.
- ✓ B.Create a Transit Gateway in the central account and attach the central VPC.
- ✓ C.Accept the Transit Gateway share in each spoke account and attach their VPCs.
- D.Deploy a firewall appliance in each spoke VPC.
- ✓ E.Use AWS Resource Access Manager to share the Transit Gateway with spoke accounts.
Why B: A Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.