ANS-C01 Network Implementation Practice Question
A company has deployed a multi-account AWS environment using AWS Organizations. Each account has one or more VPCs that need to communicate with each other and with an on-premises data center via a central transit VPC. The company uses AWS Transit Gateway with a centralized network account that hosts the Transit Gateway. VPCs from other accounts are attached to the Transit Gateway via Resource Access Manager (RAM) shares. The network team notices that after attaching a new VPC from a member account, resources in that VPC cannot communicate with resources in other attached VPCs. The Transit Gateway route tables have appropriate routes, and the VPC route tables point to the Transit Gateway. What is the MOST likely cause of the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Transit Gateway attachment in the member account is in the 'pending acceptance' state and not yet accepted by the Transit Gateway owner.
When a Transit Gateway attachment is shared via AWS Resource Access Manager (RAM), the attachment must be accepted by the Transit Gateway owner in the central network account. Until acceptance, the attachment remains in a 'pending acceptance' state, and traffic cannot flow through it. Since the problem states that route tables are correctly configured and VPC routes point to the Transit Gateway, the most likely cause is that the new VPC's attachment has not yet been accepted, which corresponds to option A.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Transit Gateway attachment in the member account is in the 'pending acceptance' state and not yet accepted by the Transit Gateway owner.
Why this is correct
The owner must accept the attachment for it to be active.
- ✗
The Transit Gateway route table does not have the routes from the new VPC propagated.
Why it's wrong here
Propagation is not needed; static routes can be added.
- ✗
The new VPC's CIDR overlaps with an existing attachment's CIDR.
Why it's wrong here
Overlap would cause routing issues but not complete failure to communicate.
- ✗
The member account's VPC does not have a route to the Transit Gateway in its route tables.
Why it's wrong here
The stem states VPC route tables point to Transit Gateway.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A large enterprise uses AWS Organizations with multiple accounts. The central networking account hosts a Transit Gateway with attachments from VPCs in various accounts. The enterprise uses AWS Resource Access Manager (RAM) to share the Transit Gateway with other accounts. A network engineer in a spoke account creates a VPC and attaches it to the shared Transit Gateway. The attachment shows 'available' state. However, traffic from the spoke VPC to other attached VPCs fails. The spoke VPC route table has a route to the Transit Gateway for 0.0.0.0/0. The Transit Gateway route table has routes for the spoke VPC CIDR and other VPC CIDRs. What is the most likely cause?
hard- A.The spoke account does not have an IAM role to access the Transit Gateway
- B.The spoke VPC route table does not have routes to the other VPC CIDRs
- C.The Transit Gateway route table does not propagate routes from the spoke VPC attachment
- ✓ D.The Transit Gateway owner has not accepted the VPC attachment
Why D: When a Transit Gateway is shared via AWS Resource Access Manager (RAM), the owner account must accept the VPC attachment request from the spoke account. Even though the attachment state shows 'available', it might not be fully accepted and associated with the Transit Gateway route table. If the owner has not accepted, the attachment will not be associated with a route table, causing traffic failure. Option B is incorrect because the spoke VPC route table has a default route to the Transit Gateway, so traffic is directed there. Option C is incorrect because the Transit Gateway route table already contains routes for the VPC CIDRs; propagation is not needed for static routes. Option A is incorrect because IAM roles are not required for VPC attachment to a shared Transit Gateway. Therefore, the most likely cause is that the owner has not accepted the attachment, making option D correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.