Transit Gateway Firewall Inspection — Centralized Traffic Routing
A company has multiple VPCs connected via AWS Transit Gateway. They need to inspect all inter-VPC traffic using a centralized firewall appliance. What is the most efficient way to achieve this?
Quick Answer
The answer is to attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance. This works because Transit Gateway acts as a central hub for routing between VPCs, and by attaching the firewall to a dedicated inspection VPC or directly as a transit gateway attachment, you can create specific route table entries that force all inter-VPC traffic through the appliance for centralized traffic inspection. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of Transit Gateway route tables and how to implement a centralized inspection architecture without complex peering or additional load balancers. A common trap is confusing this with VPC endpoints or Network Load Balancers, which do not perform packet inspection. Remember the key: Transit Gateway route tables are the control plane for directing traffic, not the firewall itself. Memory tip: think of the Transit Gateway as a router and the firewall as a next-hop — just set the route table to point all inter-VPC traffic to that next-hop attachment.
⚠ Common exam trap
Test-takers frequently confuse Transit Gateway route tables with VPC route tables, assuming they can simply point VPC routes to the firewall, but the Transit Gateway's centralized route table is the key to efficiently steering all inter-VPC traffic through a single inspection point without per-VPC configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance
Attaching the firewall appliance to the Transit Gateway and configuring Transit Gateway route tables to send traffic to the appliance is the most efficient method because it allows the Transit Gateway to act as a central hub, directing all inter-VPC traffic through the firewall for inspection without requiring complex peering or per-VPC routing changes. This leverages the Transit Gateway's route table capabilities to create a single inspection point, minimizing latency and administrative overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance
Why this is correct
This centralizes inspection by routing inter-VPC traffic through the firewall appliance.
- ✗
Enable VPC Flow Logs and analyze traffic patterns
Why it's wrong here
Flow Logs only provide logs, not active traffic inspection.
- ✗
Create VPC Gateway Endpoints for each VPC and route traffic through them
Why it's wrong here
Gateway Endpoints are only for S3 and DynamoDB, not for traffic inspection.
- ✗
Use a Network Load Balancer to distribute traffic to the firewall appliance
Why it's wrong here
NLB does not inspect traffic; it only load balances.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. They need to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the routing?
easy- A.Use Network ACLs on the subnets to restrict traffic and allow inspection.
- B.Create VPC peering connections between all VPCs and route traffic through a security appliance in a central VPC.
- C.Use security groups on the security appliance to inspect traffic.
- ✓ D.Create a Transit Gateway with separate route tables. Attach each VPC and the Direct Connect virtual interface to the Transit Gateway. In the route tables, propagate routes and add static routes to send inter-VPC traffic to the security appliance VPC.
Why D: AWS Transit Gateway supports separate route tables, allowing you to isolate traffic domains. By attaching each VPC and the Direct Connect virtual interface to the Transit Gateway, you can create a centralized inspection VPC. Static routes in the Transit Gateway route tables direct inter-VPC traffic to the security appliance VPC, ensuring all traffic between VPCs is inspected before reaching its destination.
Variation 2. A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a network virtual appliance. Which architecture should they use?
easy- A.Use a Network Load Balancer in each VPC to forward traffic to the appliance.
- B.Attach the appliance directly to each VPC using VPC Peering.
- ✓ C.Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.
- D.Place the appliance in each VPC and configure VPC Peering.
Why C: It uses an inspection VPC as a central point for traffic inspection. By attaching the network virtual appliance to a dedicated inspection VPC and configuring Transit Gateway route tables to route inter-VPC traffic to that attachment, all traffic between VPCs is forced through the appliance for inspection. This leverages Transit Gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without complex peering or per-VPC appliance deployments.
Variation 3. A company wants to connect two VPCs in the same AWS region using a hub-and-spoke model. Which AWS service should be used to route traffic between the VPCs through a central inspection VPC?
easy- A.AWS Direct Connect
- ✓ B.AWS Transit Gateway
- C.AWS VPN CloudHub
- D.VPC Peering
Why B: AWS Transit Gateway is the correct choice because it acts as a central hub that connects multiple VPCs and on-premises networks in a hub-and-spoke topology. It allows you to route traffic between VPCs through a central inspection VPC for security or compliance purposes, using route tables to control traffic flow without requiring individual peering connections.
Variation 4. A company is designing a global network with multiple VPCs connected via AWS Transit Gateway. The company wants to route traffic between VPCs through a centralized inspection VPC that hosts firewalls. Which configurations are required? (Choose THREE.)
hard- ✓ A.Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.
- B.Create VPC endpoints for the inspection services.
- ✓ C.Add static routes in the Transit Gateway route tables for VPC attachments.
- ✓ D.Propagate VPC attachment routes to a dedicated route table.
- E.Establish VPC peering connections between each VPC and the inspection VPC.
Why A: Configuring a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment forces all inter-VPC traffic that does not match a more specific route to be sent to the inspection VPC for firewall inspection. This is a common pattern for centralized inspection, where the inspection VPC acts as a next hop for all traffic between VPCs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.