ANS-C01 Network Management and Operations Practice Question
A company has a multi-account AWS environment using AWS Organizations. Each account contains a VPC with a private subnet and a public subnet. The company uses a centralized inspection VPC in the network account with third-party firewall appliances. All internet-bound traffic from the VPCs must be routed through the inspection VPC via an AWS Transit Gateway. The network team has configured the transit gateway with separate route tables: one for the inspection VPC and one for the spoke VPCs. The spoke VPCs have a default route (0.0.0.0/0) pointing to the transit gateway. The inspection VPC has a default route pointing to an egress VPC that has an internet gateway. However, traffic from a spoke VPC is not reaching the internet. The network engineer has verified that the firewall appliances are running and that the security groups and NACLs allow traffic. What is the most likely cause of the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The inspection VPC route table does not have a route to the transit gateway for the spoke VPC CIDRs.
For traffic from a spoke VPC to reach the internet via the inspection VPC, the inspection VPC must be able to route return traffic back to the spoke VPC. The inspection VPC's route table requires routes for each spoke VPC's CIDR blocks with the Transit Gateway as the target. Without these routes, the firewall cannot forward return traffic, causing the initial connection to time out and internet access to fail. Option B is similar but misstates the requirement. Options C and D describe different issues that do not align with the described symptoms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The inspection VPC route table does not have a route to the transit gateway for the spoke VPC CIDRs.
Why this is correct
Correct: Without a route to the transit gateway, the firewall cannot send traffic back to the spoke VPCs.
- ✗
The inspection VPC route table does not have a route to the spoke VPC CIDRs via the transit gateway.
Why it's wrong here
Incorrect: The inspection VPC needs a route to the transit gateway for return traffic, not to the spoke VPCs.
- ✗
The inspection VPC route table has a blackhole route for the spoke VPC CIDRs.
Why it's wrong here
Incorrect: A blackhole route would drop traffic, but the issue is missing route.
- ✗
The transit gateway route table for the spoke VPCs does not have a route to the egress VPC.
Why it's wrong here
Incorrect: The spoke VPCs send traffic to the inspection VPC; the inspection VPC handles egress.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A financial services company is deploying a multi-account environment using AWS Organizations. The security team requires that all network traffic to and from the internet must flow through a centralized inspection VPC that hosts third-party firewall appliances. The architecture uses a single AWS Transit Gateway with a centralized inspection VPC attached. Which THREE steps are necessary to enforce this architecture? (Choose THREE.)
hard- ✓ A.Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.
- B.Use AWS Organizations service control policies to prevent direct internet access from spoke VPCs.
- C.Deploy VPC Gateway Endpoints for S3 and DynamoDB in each spoke VPC.
- ✓ D.In the inspection VPC, route traffic from the transit gateway to the firewall appliances, then back to the transit gateway for egress.
- ✓ E.Create separate transit gateway route tables for the inspection VPC and spoke VPCs, and propagate routes appropriately.
Why A: Spoke VPCs need a default route (0.0.0.0/0) pointing to the transit gateway attachment to send internet-bound traffic to the inspection VPC. Option D is correct: in the inspection VPC, traffic from the transit gateway must be routed to the firewall appliances, inspected, and then sent back to the transit gateway for egress to the internet. Option E is correct: separate transit gateway route tables for the inspection VPC and spoke VPCs are required, with appropriate propagation and static routes to enforce traffic flow through the inspection VPC. Option B is incorrect because service control policies (SCPs) can be used to restrict actions in AWS Organizations but do not directly enforce routing; routing is handled via route tables. Option C is incorrect because VPC Gateway Endpoints for S3 and DynamoDB do not affect internet traffic routing; they provide private access to those services.
Variation 2. A financial company has a multi-account AWS environment using AWS Organizations. They have deployed a centralized inspection VPC with a third-party firewall appliance. All VPCs are attached to a Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by the firewall. The firewall is deployed in an Auto Scaling group behind a Network Load Balancer (NLB). What is the BEST way to route traffic to the firewall?
hard- A.Use a Gateway Load Balancer (GWLB) endpoint in each VPC to route traffic to the firewall.
- B.Use VPC peering between each VPC and the inspection VPC.
- C.Deploy a firewall appliance in each VPC and route traffic locally.
- ✓ D.Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.
Why D: The best approach. By creating a Transit Gateway attachment in the inspection VPC and configuring the Network Load Balancer (NLB) as the target, all inter-VPC traffic can be routed through the firewall via Transit Gateway route tables. This ensures centralized inspection without introducing complexity. Option A is incorrect because a Gateway Load Balancer (GWLB) is not needed here; the NLB already provides load balancing for the firewall instances. Option B is incorrect because VPC peering bypasses the Transit Gateway, defeating centralized inspection. Option C is incorrect because deploying a firewall in each VPC is not centralized and increases management overhead.
Variation 3. A company has a multi-account AWS environment using AWS Transit Gateway with a centralized network account. The network team wants to ensure that only specific VPCs can communicate with each other. What is the best practice to achieve this?
medium- A.Configure security groups in each VPC to allow traffic only from specific VPC CIDRs.
- B.Use VPC peering connections between the VPCs that need to communicate.
- ✓ C.Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.
- D.Use AWS Network Manager to create routing policies.
Why C: Transit Gateway route tables allow you to control routing between VPC attachments. By creating multiple route tables and associating each VPC attachment with the appropriate one, you can isolate or allow communication as needed. Option A is wrong because security groups operate at the instance/ENI level, not at the transit gateway level, so they cannot control VPC-to-VPC communication via Transit Gateway. Option B is wrong because VPC peering is point-to-point and does not scale well, nor does it leverage the centralized Transit Gateway. Option D is wrong because AWS Network Manager is used for monitoring and visualizing global networks, not for defining routing policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.