ANS-C01 Network Design Practice Question
A company has multiple VPCs connected via a Transit Gateway. Each VPC has its own CIDR block. The company wants to isolate network traffic between specific VPCs. What is the most scalable way to achieve this?
⚠ Common exam trap
Candidates often assume Security Groups or Network Firewall are the only ways to isolate traffic, but the question specifically asks for the most scalable method, which is achieved by Transit Gateway route tables rather than per-VPC firewall appliances or instance-level security groups.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.
Transit Gateway route tables allow you to isolate traffic between VPCs by controlling which VPC attachments can communicate with each other. By associating each VPC attachment with a specific route table and configuring route propagation appropriately, you can enforce isolation without additional appliances or complex routing. This approach scales seamlessly as you add more VPCs, because you simply create new route tables and associate attachments as needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy AWS Network Firewall in each VPC.
Why it's wrong here
Overly complex and costly for simple isolation.
- ✓
Create separate Transit Gateway route tables and associate VPC attachments to the appropriate route tables.
Why this is correct
Transit Gateway route tables provide scalable isolation.
- ✗
Use Security Groups in each VPC to filter traffic.
Why it's wrong here
Security Groups cannot control traffic across VPCs.
- ✗
Use VPC Peering connections and modify route tables.
Why it's wrong here
VPC Peering is not transitive and requires many connections.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.