ANS-C01 Transit Gateway route table Practice Question
A company is designing a hybrid network using AWS Transit Gateway. The company has three VPCs (VPC-A, VPC-B, VPC-C) all attached to the same Transit Gateway. The on-premises network connects to the Transit Gateway via a Direct Connect gateway. The company needs to ensure that VPC-C can communicate with the on-premises network but not with VPC-A or VPC-B. Which TWO actions should the network engineer take?
⚠ Common exam trap
A common mix-up: candidates confuse security groups or network ACLs as mechanisms to control inter-VPC traffic across a Transit Gateway, when in fact route table isolation is the correct method to enforce such network segmentation at the transit layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate the VPC-C route table with the Direct Connect gateway attachment.
Associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with the on-premises network via the Transit Gateway, enabling communication. Option D is correct because creating a separate Transit Gateway route table for VPC-C and not propagating VPC-A and VPC-B routes ensures that VPC-C has no routes to those VPCs, effectively isolating it from them at the network layer. Option A is incorrect because a VPN attachment does not provide connectivity to on-premises via Direct Connect; the Direct Connect gateway attachment is required. Option C is incorrect because VPC peering enables direct communication between VPCs, which is not desired. Option E is incorrect because network ACLs at the subnet level do not control routing across a Transit Gateway; route table isolation is needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Establish a VPN attachment between VPC-C and the Direct Connect gateway.
Why it's wrong here
Incorrect: A VPN attachment would route traffic over the public internet, contrary to the requirement for a hybrid connection via Direct Connect, and does not directly connect to on-premises through the Transit Gateway in this context.
- ✓
Associate the VPC-C route table with the Direct Connect gateway attachment.
Why this is correct
Correct: Associating the VPC-C route table with the Direct Connect gateway attachment allows VPC-C to exchange routes with on-premises, enabling communication.
- ✗
Establish VPC peering connections between VPC-C and VPC-A, and VPC-C and VPC-B.
Why it's wrong here
Incorrect: VPC peering would enable direct communication between VPC-C and VPC-A/B, which violates the requirement to isolate VPC-C from them.
- ✓
Create a separate Transit Gateway route table for VPC-C and do not propagate VPC-A and VPC-B routes.
Why this is correct
Correct: A separate route table for VPC-C without propagation of routes from VPC-A and VPC-B ensures no routing to those VPCs, isolating VPC-C at the network layer.
- ✗
Apply a network ACL on VPC-C subnets to block traffic from VPC-A and VPC-B.
Why it's wrong here
Incorrect: Network ACLs filter traffic at the subnet level but do not affect routing within the Transit Gateway; route table isolation is required to prevent communication.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.