ANS-C01 Network Implementation Practice Question
A company has a large AWS environment with hundreds of VPCs connected via a Transit Gateway. The network team is implementing a new hub-and-spoke architecture where all traffic between VPCs must be inspected by a centralized firewall appliance in a shared services VPC. The firewall appliance is a third-party virtual appliance that supports VRF-like segmentation. The network engineer has configured the Transit Gateway with separate route tables for each VPC, and the shared services VPC is associated with all route tables. The firewall appliance is deployed in the shared services VPC with two ENIs: one in a 'trust' subnet and one in an 'untrust' subnet. The trust subnet is used for traffic coming from spoke VPCs, and the untrust subnet is used for traffic going to other spoke VPCs. The firewall appliance performs stateful inspection and returns traffic to the Transit Gateway via the correct ENI. However, after implementation, traffic between two spoke VPCs (VPC A and VPC B) is being dropped. The engineer verifies that the Transit Gateway route tables have static routes for each spoke VPC CIDR pointing to the shared services VPC attachment. The spoke VPCs have routes to each other's CIDR via the Transit Gateway. The firewall logs show that traffic from VPC A reaches the trust ENI, but the firewall is unable to send traffic to VPC B because it does not have a route to VPC B's CIDR. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on Transit Gateway route tables and forget that the subnet route tables within the shared services VPC must also be configured to route traffic back to the Transit Gateway, especially when using a firewall with separate ENIs for trust and untrust subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table for the untrust subnet does not have a route to VPC B's CIDR pointing to the Transit Gateway.
The firewall's untrust subnet route table must have a route pointing to the Transit Gateway for VPC B's CIDR. The firewall receives traffic from VPC A on its trust ENI, processes it, and then sends it out the untrust ENI. Without a route in the untrust subnet's route table directing traffic for VPC B's CIDR to the Transit Gateway, the firewall cannot forward the traffic back to the Transit Gateway for delivery to VPC B, causing the drop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The shared services VPC attachment is not propagating routes to the Transit Gateway route tables.
Why it's wrong here
Propagation is not required; static routes are used.
- ✗
The security group for the firewall's untrust ENI is blocking outbound traffic.
Why it's wrong here
Security groups are stateful; if inbound traffic is allowed, outbound return traffic is automatically allowed.
- ✗
The Transit Gateway route table for VPC A does not have a route for VPC B's CIDR.
Why it's wrong here
The engineer verified that static routes are in place.
- ✓
The route table for the untrust subnet does not have a route to VPC B's CIDR pointing to the Transit Gateway.
Why this is correct
The untrust subnet needs a route to return traffic to the Transit Gateway. Without it, the firewall cannot send traffic to VPC B.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.