ANS-C01 Network Design Practice Question
A company has a hub-and-spoke network topology using AWS Transit Gateway in us-east-1. The hub VPC hosts centralized inspection appliances from a third-party vendor. The spokes include VPCs with application workloads and a Direct Connect VIF attached to a Direct Connect gateway which is associated with the Transit Gateway. The company notices that traffic from the on-premises network to the spoke VPCs is not being inspected by the centralized appliances. They have verified that the Transit Gateway route tables are correctly configured with static routes pointing to the inspection VPC for all spoke CIDRs, and the inspection appliances are properly configured to forward traffic. What is the most likely cause of this issue?
⚠ Common exam trap
Many exam-takers assume configuring routes in the spoke VPC route tables or the inspection VPC is sufficient, but they overlook that the Transit Gateway route table associated with the Direct Connect gateway attachment must also direct traffic to the inspection VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Transit Gateway route table associated with the Direct Connect gateway attachment does not have a route that sends traffic to the inspection VPC.
In a hub-and-spoke topology with AWS Transit Gateway, traffic from on-premises (via Direct Connect) to spoke VPCs must be routed through the inspection VPC. This requires the Transit Gateway route table associated with the Direct Connect gateway attachment to contain a static route pointing to the inspection VPC attachment for the spoke CIDRs. Without this route, traffic bypasses inspection entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Direct Connect gateway is not propagating routes to the Transit Gateway, causing the on-premises traffic to be dropped.
Why it's wrong here
If routes were not propagated, traffic would not reach the Transit Gateway at all. The issue is that traffic reaches the spoke directly, bypassing inspection.
- ✓
The Transit Gateway route table associated with the Direct Connect gateway attachment does not have a route that sends traffic to the inspection VPC.
Why this is correct
The route table associated with the attachment determines the path. Without a specific route to the inspection VPC, traffic goes directly to the spoke.
- ✗
The inspection VPC is sending traffic back to the on-premises network via a different path, causing asymmetric routing that drops packets.
Why it's wrong here
Asymmetric routing could occur, but the primary cause is the missing route; the inspection VPC may be configured correctly but traffic never reaches it.
- ✗
The Transit Gateway route table for the spoke VPC attachments does not have a route to the on-premises network via the Direct Connect gateway.
Why it's wrong here
This would cause spoke VPCs to be unreachable from on-premises, but the issue is that traffic is not being inspected, not that it is unreachable.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.