ANS-C01 Network Management and Operations Practice Question
A company has a multi-VPC architecture using AWS Transit Gateway (TGW). They have a central inspection VPC with a Gateway Load Balancer (GWLB) and third-party firewall appliances. All other VPCs are attached to the TGW and have route tables that send traffic to the inspection VPC for inspection. Recently, the network team deployed a new VPC (VPC-D) and attached it to the TGW. They configured the VPC-D route table to send all inter-VPC traffic to the TGW. However, traffic from VPC-D to other VPCs is not being inspected. The team confirmed that the firewall appliances are healthy and the GWLB is correctly configured. Which action should the network team take to ensure traffic from VPC-D is inspected?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.
Each VPC attached to a Transit Gateway is associated with a specific TGW route table. This route table controls how traffic from that VPC is forwarded to other attachments. For traffic from VPC-D to be inspected, the TGW route table associated with VPC-D's attachment must include routes that direct traffic to the inspection VPC's attachment (where the Gateway Load Balancer and firewall appliances reside). Simply attaching VPC-D does not automatically associate it with the correct route table; the network team must explicitly associate VPC-D's attachment with the existing route table that routes traffic to the inspection VPC. Option D correctly describes this action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable route propagation on VPC-D's TGW attachment.
Why it's wrong here
Route propagation is for VPN attachments, not VPC attachments.
- ✗
Add a route in VPC-D's subnet route tables pointing to the TGW for all traffic.
Why it's wrong here
VPC-D already has a route to TGW; the issue is in the TGW route table, not the VPC route table.
- ✗
Create a new TGW route table and associate all VPC attachments to it.
Why it's wrong here
This does not specifically direct traffic through inspection.
- ✓
Associate VPC-D's TGW attachment with the correct TGW route table that routes traffic to the inspection VPC.
Why this is correct
This ensures TGW forwards traffic from VPC-D through the inspection VPC.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.