ANS-C01 Network Implementation Practice Question
A company has multiple AWS accounts and wants to centrally manage network security using AWS Network Firewall. The firewall must inspect traffic between VPCs in the same Region. Which deployment model achieves this with minimal latency?
⚠ Common exam trap
Many exam-takers confuse VPC peering with transitive routing, assuming that connecting all VPCs to a central VPC via peering allows traffic to flow through the firewall, but VPC peering does not support transitive routing, so traffic between two spoke VPCs would not be inspected unless explicitly routed through the central VPC, which is not natively supported.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.
AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs route traffic through a central inspection VPC. By attaching AWS Network Firewall as a VPC attachment to the transit gateway, traffic between VPCs is routed through the firewall for inspection with minimal latency because the firewall is deployed inline within the transit gateway route table, avoiding the overhead of multiple peering connections or third-party appliances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy AWS Network Firewall in each VPC and configure VPC peering between VPCs.
Why it's wrong here
This does not provide centralized management and inspection of inter-VPC traffic without additional routing.
- ✗
Deploy AWS Network Firewall in a shared services VPC and use VPC peering to connect all VPCs.
Why it's wrong here
VPC peering is point-to-point and does not support transitive routing, so traffic would not go through the firewall automatically.
- ✓
Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.
Why this is correct
This centralizes inspection and routes traffic through the firewall with minimal latency.
- ✗
Use a centralized inspection VPC with a Gateway Load Balancer and third-party appliances.
Why it's wrong here
While this works, the question specifically asks for AWS Network Firewall, which is a managed service that can be attached directly to Transit Gateway.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.