ANS-C01 Network Design Practice Question
A company is deploying a critical application across multiple AWS accounts. The network team wants to simplify IP address management and ensure that VPCs in different accounts can communicate securely. The company has a centralized network account with a transit gateway. Which architecture should the company use?
⚠ Common exam trap
It's easy for candidates to confuse VPC peering (which requires full mesh for transitive routing) with transit gateway (which provides transitive routing natively), or mistakenly think VPC endpoints can be used for inter-VPC communication instead of their intended purpose of private access to AWS services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.
AWS Resource Access Manager (RAM) allows you to share a transit gateway from a centralized network account with other AWS accounts, enabling VPCs in those accounts to attach to the shared transit gateway. This simplifies IP address management by providing a single hub for inter-VPC routing and avoids the complexity of managing multiple VPC peering connections. The transit gateway supports transitive routing, so VPCs in different accounts can communicate securely through the centralized gateway without needing direct peering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Resource Access Manager to share the transit gateway in the network account with other accounts and attach their VPCs.
Why this is correct
RAM enables cross-account sharing of transit gateways.
- ✗
Create VPC peering connections between each VPC in different accounts.
Why it's wrong here
VPC peering creates a full mesh, which is complex to manage.
- ✗
Configure VPC endpoints in each account to communicate through the network account.
Why it's wrong here
VPC endpoints are for accessing AWS services privately.
- ✗
Set up AWS Direct Connect between accounts and route through the network account.
Why it's wrong here
Direct Connect is for on-premises connectivity, not inter-account.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to connect multiple VPCs across different AWS accounts to a common on-premises network using AWS Transit Gateway. Which resource should be used to allow cross-account VPC attachments?
easy- A.AWS PrivateLink
- B.VPC peering connection
- C.AWS Organizations
- ✓ D.AWS Resource Access Manager (RAM)
Why D: AWS Resource Access Manager (RAM) enables you to share a Transit Gateway with other AWS accounts within your organization or externally. Once shared, the recipient account can attach its VPCs to the shared Transit Gateway, allowing cross-account VPC attachments to a common on-premises network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.