ANS-C01 Network Management and Operations Practice Question
A company has a multi-account AWS environment using AWS Transit Gateway with a centralized network account. The network team wants to ensure that only specific VPCs can communicate with each other. What is the best practice to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.
Transit Gateway route tables allow you to control routing between VPC attachments. By creating multiple route tables and associating each VPC attachment with the appropriate one, you can isolate or allow communication as needed. Option A is wrong because security groups operate at the instance/ENI level, not at the transit gateway level, so they cannot control VPC-to-VPC communication via Transit Gateway. Option B is wrong because VPC peering is point-to-point and does not scale well, nor does it leverage the centralized Transit Gateway. Option D is wrong because AWS Network Manager is used for monitoring and visualizing global networks, not for defining routing policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure security groups in each VPC to allow traffic only from specific VPC CIDRs.
Why it's wrong here
Security groups are stateful firewalls at the instance level; they do not control Transit Gateway routing and add unnecessary complexity.
- ✗
Use VPC peering connections between the VPCs that need to communicate.
Why it's wrong here
VPC peering is a point-to-point connection that does not scale well in a multi-account environment with many VPCs.
- ✓
Create multiple Transit Gateway route tables and associate each VPC attachment with the appropriate route table.
Why this is correct
Multiple Transit Gateway route tables allow you to isolate VPC attachments and control which VPCs can communicate by managing route propagation and static routes.
- ✗
Use AWS Network Manager to create routing policies.
Why it's wrong here
AWS Network Manager is used for monitoring and visualizing the network, not for creating routing policies; routing control is achieved through Transit Gateway route tables.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.