ANS-C01 Network Implementation Practice Question
A company has an AWS Transit Gateway with multiple VPC attachments. They need to inspect traffic between VPCs using a third-party firewall appliance. What is the best approach?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that security groups or network ACLs can be used for inter-VPC traffic inspection, but they are per-VPC constructs that cannot inspect traffic traversing a Transit Gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it
The best approach is to create a dedicated firewall VPC that hosts the third-party firewall appliance and use Transit Gateway (TGW) route tables to steer inter-VPC traffic through that VPC. By attaching the firewall VPC to the TGW and configuring route tables with static routes pointing to the firewall VPC attachment, all traffic between other VPCs can be forced to traverse the firewall for inspection. This provides centralized, scalable traffic inspection without requiring changes to individual VPC routing or security group configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a firewall VPC with the appliance and use Transit Gateway route tables to direct traffic through it
Why this is correct
This allows centralized inspection via routing.
- ✗
Use VPC security groups across VPCs
Why it's wrong here
Security groups cannot be applied across VPC peering or Transit Gateway.
- ✗
Use AWS Network Firewall directly in each VPC
Why it's wrong here
AWS Network Firewall operates per-VPC, not at the Transit Gateway, so it cannot inspect traffic flowing between VPCs across the Transit Gateway—it only filters traffic entering or leaving a single VPC. This option is tempting because AWS Network Firewall provides centralised rule management and stateful inspection for individual VPCs, and would be correct if the requirement were to inspect internet-bound or on-premises traffic from each VPC independently rather than inter-VPC traffic traversing the Transit Gateway.
- ✗
Use network ACLs on each VPC subnet
Why it's wrong here
Network ACLs are stateless and do not provide deep packet inspection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.