ANS-C01 Network Design Practice Question
A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. Which THREE steps are necessary?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that VPC peering can be used for transitive routing through a central inspection VPC, but peering is non-transitive and requires a full mesh, making Transit Gateway with GWLB the correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a Gateway Load Balancer (GWLB) in the firewall VPC and register the firewall instances as targets
A Gateway Load Balancer (GWLB) is designed to transparently insert third-party firewall appliances into network traffic paths. By deploying a GWLB in the firewall VPC and registering the firewall instances as targets, traffic can be inspected at Layer 3/4 without modifying the source or destination IP addresses, enabling seamless integration with Transit Gateway routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a VPC peering connection between the VPCs to allow traffic flow
Why it's wrong here
VPC peering would bypass Transit Gateway and the firewall inspection.
- ✓
Deploy a Gateway Load Balancer (GWLB) in the firewall VPC and register the firewall instances as targets
Why this is correct
GWLB integrates with Transit Gateway and transparently routes traffic to the firewall instances.
- ✓
Configure Transit Gateway route tables to route traffic between VPCs through the firewall VPC
Why this is correct
Route tables control traffic flow; they must point to the firewall VPC attachment for inter-VPC traffic.
- ✗
Configure a NAT Gateway in each VPC to route traffic through the firewall
Why it's wrong here
NAT Gateway is for outbound internet traffic, not for east-west inspection.
- ✓
Attach a VPC containing the firewall appliance to the Transit Gateway
Why this is correct
The firewall VPC must be attached to the Transit Gateway to receive traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.