ANS-C01 AWS PrivateLink Practice Question
A company has a multi-VPC architecture with VPCs in the same region. They need to ensure that traffic between VPCs never traverses the public internet and is encrypted in transit. Which solution meets these requirements with the lowest operational overhead?
⚠ Common exam trap
A common trap is assuming VPC peering provides encryption (it does not) or that Transit Gateway VPN attachments can connect VPCs directly (they are for on-premises connectivity). Privatelink meets both requirements with minimal overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS PrivateLink to connect VPCs via Network Load Balancers.
AWS PrivateLink allows you to connect VPCs privately using VPC endpoints and Network Load Balancers. Traffic stays within the AWS network and never traverses the public internet. When the application uses TLS/HTTPS, the traffic is encrypted end-to-end. This solution has low operational overhead because PrivateLink is fully managed and requires no VPN tunnels or third-party appliances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS PrivateLink to connect VPCs via Network Load Balancers.
Why this is correct
Correct. PrivateLink keeps traffic within AWS network and supports encryption via TLS; it is fully managed with low overhead.
- ✗
Use AWS Transit Gateway with IPsec VPN attachments between VPCs.
Why it's wrong here
Incorrect. Transit Gateway VPN attachments are designed for connecting on-premises networks, not for direct inter-VPC connectivity. AWS does not support creating a VPN attachment between two VPCs via Transit Gateway.
- ✗
Use VPC peering connections between all VPCs.
Why it's wrong here
Incorrect. VPC peering provides private connectivity but does not encrypt traffic. Data traverses the AWS network unencrypted unless application-level encryption is used.
- ✗
Use AWS Transit Gateway with VPC attachments and enable multicast.
Why it's wrong here
Incorrect. Transit Gateway multicast is used for multicast traffic and does not provide encryption. It also does not ensure traffic is encrypted in transit.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.