ANS-C01 Network Design Practice Question
A company has multiple VPCs connected via a Transit Gateway. They want to implement network segmentation so that only specific VPCs can communicate with each other. Which TWO methods can achieve this? (Choose two.)
⚠ Common exam trap
AWS often tests the misconception that security groups or network ACLs can control inter-VPC traffic across a Transit Gateway, but these constructs are limited to within a single VPC and do not affect transit routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy AWS Network Firewall in a centralized inspection VPC
AWS Network Firewall can be deployed in a centralized inspection VPC to filter traffic between VPCs attached to a Transit Gateway. By routing inter-VPC traffic through the firewall appliance, you can enforce stateful inspection and allow or deny traffic based on source/destination VPCs, achieving network segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy AWS Network Firewall in a centralized inspection VPC
Why this is correct
Network Firewall can filter traffic between VPCs.
- ✓
Use Transit Gateway route tables with specific associations and propagations
Why this is correct
Allows selective routing between VPC attachments.
- ✗
Assign instances to different security groups
Why it's wrong here
Security groups work at instance level, not network level.
- ✗
Configure network ACLs on each subnet
Why it's wrong here
NACLs are stateless and per subnet, not for inter-VPC filtering.
- ✗
Create separate VPC peering connections
Why it's wrong here
Overcomplicates and not centralized.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.