ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The security team requires that all traffic between VPCs must be inspected by a centralized firewall appliance deployed in a security VPC. They have configured a Transit Gateway with a route table that has blackhole routes for all VPC CIDRs except the security VPC, and the security VPC appliance performs inspection and returns traffic to the Transit Gateway. Recently, they added a new VPC for a critical application. After configuration, some traffic from the new VPC to other VPCs is being dropped. The network engineer verifies that the Transit Gateway route table includes a blackhole route for the new VPC's CIDR and that the security VPC's firewall rules allow the traffic. What is the most likely cause of the dropped traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Transit Gateway route table does not have a static route pointing to the security VPC attachment for the new VPC's CIDR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security VPC's network ACLs are blocking return traffic from the firewall appliance back to the Transit Gateway.
Why it's wrong here
The issue is with traffic from the new VPC to other VPCs, not return traffic. The security VPC firewall rules are verified to allow the traffic. Network ACLs would affect both directions, but the stem states firewall rules are correct.
- ✗
The new VPC's route table does not have a default route pointing to the Transit Gateway attachment.
Why it's wrong here
The new VPC's route table should have a route to the Transit Gateway for traffic to other VPCs. If missing, traffic would not reach the Transit Gateway at all. However, the stem indicates that some traffic is being dropped, implying connectivity exists but is blackholed.
- ✗
The Transit Gateway route table propagates the new VPC's CIDR, overriding the static blackhole route.
Why it's wrong here
If propagation is enabled, the new VPC's CIDR would be propagated and appear as a route directly to the new VPC attachment, bypassing the security VPC. But the stem states there is a blackhole route for the new VPC's CIDR, which would override propagation if static routes have higher precedence.
- ✓
The Transit Gateway route table does not have a static route pointing to the security VPC attachment for the new VPC's CIDR.
Why this is correct
The Transit Gateway route table must have a route for the new VPC's CIDR pointing to the security VPC attachment so that traffic from the new VPC is forwarded to the firewall for inspection. Without this route, traffic is blackholed.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Transit Gateway to connect multiple VPCs. The security team wants to inspect all traffic between VPCs with a third-party firewall appliance deployed in a centralized inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?
medium- A.Create VPC peering connections between all VPCs and route traffic through the inspection VPC.
- B.Use AWS PrivateLink to route traffic through the inspection VPC.
- ✓ C.Configure Transit Gateway route tables with a blackhole route for the inter-VPC traffic and a route pointing to the inspection VPC.
- D.Attach a Network Load Balancer in each VPC and route traffic through it.
Why C: By configuring Transit Gateway route tables with a blackhole route for inter-VPC traffic and a more specific route pointing to the inspection VPC, traffic between VPCs is forced to go through the inspection VPC for firewall inspection. Option A is wrong because VPC peering does not support transitive routing and would require full mesh. Option B is wrong because AWS PrivateLink is used for private connectivity to services, not for routing traffic between VPCs. Option D is wrong because a Network Load Balancer is not designed for traffic inspection and would add unnecessary complexity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.