ANS-C01 Network Design Practice Question
A company is designing a multi-account AWS environment using AWS Organizations. The company wants to centralize outbound internet traffic from all VPCs in all accounts through a single VPC in a shared services account. The shared services account has a VPC with a NAT gateway and an internet gateway. Which architecture meets this requirement?
⚠ Common exam trap
Many candidates assume VPC peering can be used as a hub-and-spoke solution for internet egress, but they forget that VPC peering does not support transitive routing and that NAT gateways are not reachable across a peering connection, making Option D invalid.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.
A transit gateway allows you to centrally route traffic from multiple VPCs across different AWS accounts to a shared services VPC. By attaching all VPCs to a transit gateway and configuring route tables appropriately, you can force all outbound internet traffic from the spoke VPCs to go through the shared services VPC's NAT gateway and internet gateway, centralizing egress traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create VPC gateway endpoints for all AWS services in each VPC.
Why it's wrong here
Gateway endpoints do not provide general internet access.
- ✗
Set up a VPN connection from each VPC to the shared services VPC and use the latter's internet gateway.
Why it's wrong here
VPN adds complexity and is not scalable.
- ✓
Attach all VPCs to a transit gateway and route traffic through a shared services VPC that has NAT gateway and internet gateway.
Why this is correct
Transit gateway enables transitive routing and centralized internet.
- ✗
Peer each VPC to the shared services VPC and configure a default route pointing to the shared services VPC's NAT gateway.
Why it's wrong here
VPC peering does not support transitive routing.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a network for a multi-account AWS environment using AWS Organizations. The company must centralize internet egress for all accounts. Which TWO solutions should the company use? (Choose two.)
medium- A.Use VPC Peering to connect all VPCs to the egress VPC.
- B.Deploy a AWS Client VPN endpoint in each VPC.
- ✓ C.Use AWS Transit Gateway to route traffic from all VPCs to the egress VPC.
- D.Attach an Internet Gateway to each VPC and allow direct internet access.
- ✓ E.Create a centralized egress VPC with a NAT Gateway and Internet Gateway.
Why C: AWS Transit Gateway acts as a central hub, enabling transitive routing between all attached VPCs. This allows traffic from multiple VPCs to be routed to a centralized egress VPC without requiring complex peering relationships or full mesh connectivity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.