ANS-C01 Network Design Practice Question
A company is designing a global network with multiple VPCs connected via AWS Transit Gateway. The company wants to route traffic between VPCs through a centralized inspection VPC that hosts firewalls. Which configurations are required? (Choose THREE.)
⚠ Common exam trap
AWS often tests the misconception that VPC peering can be used for transitive routing or that VPC endpoints can replace Transit Gateway for inter-VPC traffic inspection, but neither supports the required centralized inspection pattern.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.
Configuring a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment forces all inter-VPC traffic that does not match a more specific route to be sent to the inspection VPC for firewall inspection. This is a common pattern for centralized inspection, where the inspection VPC acts as a next hop for all traffic between VPCs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.
Why this is correct
Directs all inter-VPC traffic to inspection VPC.
- ✗
Create VPC endpoints for the inspection services.
Why it's wrong here
Not needed for traffic routing.
- ✓
Add static routes in the Transit Gateway route tables for VPC attachments.
Why this is correct
Static routes direct traffic to inspection VPC.
- ✓
Propagate VPC attachment routes to a dedicated route table.
Why this is correct
Needed for route propagation.
- ✗
Establish VPC peering connections between each VPC and the inspection VPC.
Why it's wrong here
Transit Gateway replaces VPC peering.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.