ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with multiple subnets and uses AWS Transit Gateway to connect to on-premises via AWS Direct Connect. They want to implement network segmentation so that certain VPCs can only communicate with specific on-premises networks. Which THREE components should they use? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Direct Connect gateway
Options B, C, and D are correct. The Direct Connect gateway (B) integrates Direct Connect with Transit Gateway. The Transit Gateway association to the Direct Connect gateway (C) enables routing between VPCs and on-premises networks. Transit Gateway route tables (D) allow separate routing domains to segment traffic. Option A (VPC peering) is not needed because Transit Gateway already handles inter-VPC routing. Option E (Site-to-Site VPN) is not required when using Direct Connect for connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC peering connections
Why it's wrong here
Not needed; Transit Gateway already handles inter-VPC routing.
- ✓
Direct Connect gateway
Why this is correct
Provides connectivity to on-premises networks.
- ✓
Transit Gateway association to Direct Connect gateway
Why this is correct
Associates the transit gateway with the Direct Connect gateway for routing.
- ✓
Transit Gateway route tables
Why this is correct
Allow segmentation by creating separate route tables for different VPCs.
- ✗
Site-to-Site VPN connection
Why it's wrong here
Not required if using Direct Connect; adds unnecessary complexity.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.