ANS-C01 Network Management and Operations Practice Question
A company has a VPC with an AWS Transit Gateway connecting multiple VPCs and an on-premises network via AWS Direct Connect. The network team needs to ensure that only specific VPCs can communicate with each other. They create a transit gateway route table for each VPC and attach the VPC to the route table. They also propagate routes from the Direct Connect virtual interface. However, after configuration, traffic between two VPCs that should not communicate is still flowing. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC attachments are using the default transit gateway route table instead of custom route tables.
The most likely cause is that the VPC attachments are using the default transit gateway route table instead of custom route tables. By default, a transit gateway has a default route table that is shared among all attachments, which can allow unintended inter-VPC traffic if the team did not explicitly associate each VPC attachment with a dedicated route table. The correct approach is to create individual route tables for each VPC and associate the respective VPC attachment with its custom route table, ensuring isolation. Option A is incorrect because VPC route tables pointing to the transit gateway are necessary for VPCs to communicate via the transit gateway; they do not cause unintended traffic by themselves. Option B is incorrect because the issue is about which route table the attachments are associated with, not whether route tables exist. Option D is incorrect because propagating Direct Connect routes into all route tables would affect on-premises connectivity, but the issue is specifically inter-VPC traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC route tables have a route for the other VPC CIDR pointing to the transit gateway.
Why it's wrong here
This is necessary for communication; but does not explain unintended traffic.
- ✗
The transit gateway route tables are not associated with the VPC attachments.
Why it's wrong here
Associations are required; but the issue is using default route table.
- ✓
The VPC attachments are using the default transit gateway route table instead of custom route tables.
Why this is correct
Default route table allows all routes.
- ✗
The Direct Connect virtual interface is propagating routes into all route tables.
Why it's wrong here
Propagation is controlled per route table.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.