ANS-C01 Network Implementation Practice Question
A company is deploying an application across multiple VPCs using AWS Transit Gateway. They need to ensure that only specific VPCs can communicate with each other. Which TWO methods can be used to isolate traffic?
⚠ Common exam trap
Many candidates confuse network ACLs or security groups as mechanisms for inter-VPC traffic control, but these operate within a VPC and cannot be applied to Transit Gateway attachments, which require route table segmentation for isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Transit Gateway Network Manager to create a network segmentation design.
Transit Gateway Network Manager provides a centralized view and allows you to create network segmentation designs by grouping resources and defining routing policies, which helps isolate traffic between specific VPCs. Option B is correct because by creating separate Transit Gateway route tables for different groups of VPCs and associating VPC attachments accordingly, you control which VPCs can route traffic to each other, effectively isolating traffic between groups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Transit Gateway Network Manager to create a network segmentation design.
Why this is correct
Network Manager helps visualize and manage segmentation.
- ✓
Create separate Transit Gateway route tables for different groups of VPCs and associate the VPC attachments accordingly.
Why this is correct
Route tables in Transit Gateway control traffic flow between attachments.
- ✗
Configure network ACLs on the VPC subnets to allow or deny traffic.
Why it's wrong here
NACLs are stateless and control traffic at the subnet level but are not designed for Transit Gateway segmentation.
- ✗
Use security groups on the Transit Gateway attachments.
Why it's wrong here
Security groups are not supported on Transit Gateway attachments.
- ✗
Implement VPC endpoints for inter-VPC communication.
Why it's wrong here
VPC endpoints are for accessing AWS services privately, not for VPC-to-VPC traffic.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.