The correct architecture is to deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it. This works because Transit Gateway enables transitive routing between multiple VPCs, allowing you to force all inter-VPC and egress traffic through a single inspection point, while AWS Network Firewall provides centralized, scalable traffic inspection without deploying appliances in every account. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of transitive routing versus VPC peering’s non-transitive nature—a common trap is choosing VPC peering or distributing firewalls per account, which increases operational overhead and breaks centralized inspection. Remember the memory tip: “TGW + NGFW = one-stop shop for traffic cops,” meaning Transit Gateway is the hub, and Network Firewall is the single inspection point, eliminating the need for per-account firewalls or complex peering meshes.
ANS-C01 Network Implementation Practice Question
This ANS-C01 practice question tests your understanding of network implementation. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is designing a multi-account AWS environment using AWS Organizations. They need to centralize VPC flow logs and network traffic inspection across all accounts. Which architecture meets these requirements with minimal operational overhead?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.
Option B is correct because a centralised inspection VPC with Transit Gateway and Network Firewall allows all traffic to be inspected. Option A is wrong because it doesn't centralize inspection. Option C is wrong because VPC peering is not transitive. Option D is wrong because AWS Network Firewall is not available in every account without Transit Gateway.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.
Why this is correct
Centralized inspection with AWS Network Firewall and Transit Gateway is recommended.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use AWS Network Firewall in each VPC and aggregate logs centrally.
Why it's wrong here
Higher operational overhead than centralised approach.
✗
Enable VPC flow logs in each account and send them to a central S3 bucket. Use Network Access Analyzer for inspection.
Why it's wrong here
Flow logs are for monitoring, not inspection; Network Access Analyzer is for auditing, not inline.
✗
Create VPC peering connections between all VPCs and deploy a third-party firewall in one VPC.
Why it's wrong here
VPC peering is not transitive, so not all VPCs can route through one.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Detailed technical explanation
How to think about this question
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.
TExam Day Tips
→Underline the problem statement mentally.
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which ANS-C01 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
Network Implementation — This question tests Network Implementation — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it. — Option B is correct because a centralised inspection VPC with Transit Gateway and Network Firewall allows all traffic to be inspected. Option A is wrong because it doesn't centralize inspection. Option C is wrong because VPC peering is not transitive. Option D is wrong because AWS Network Firewall is not available in every account without Transit Gateway.
What should I do if I get this ANS-C01 question wrong?
Identify which ANS-C01 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is setting up a new AWS account and wants to centrally manage VPC network traffic inspection across multiple accounts using a central VPC. The company uses AWS Organizations. Which architecture meets these requirements?
hard
A.Create VPC peering connections between each account's VPC and the central VPC.
✓ B.Use AWS Transit Gateway with a central inspection VPC that has firewall appliances.
C.Use VPC endpoints to route traffic to the central VPC.
D.Deploy a Network Load Balancer in each VPC and route traffic through it.
Why B: Option B is correct because using a Transit Gateway with a central inspection VPC allows centralized traffic inspection across accounts. Option A is wrong because VPC peering does not centralize inspection. Option C is wrong because Network Load Balancer is not for inspection. Option D is wrong because VPC endpoints are for specific services.
Variation 2. A company has a multi-account AWS Organizations setup with hundreds of VPCs across multiple regions. The network team needs to centralize outbound internet traffic through a set of inspection VPCs for security monitoring. Which solution is MOST scalable and cost-effective?
hard
A.Use a Network Load Balancer in each VPC to distribute traffic to inspection appliances.
✓ B.Create a Transit Gateway with a central inspection VPC that has a NAT Gateway and route all VPCs to the inspection VPC for egress.
C.Deploy a NAT Gateway in each VPC and route traffic directly to the internet.
D.Set up VPC peering between all VPCs and route traffic through a single VPC with an Internet Gateway.
Why B: Option B is correct because AWS Transit Gateway with central VPC attachment allows routing all egress traffic through inspection VPCs, and using a single NAT Gateway per AZ in the inspection VPC is scalable and cost-effective. Option A is wrong because each VPC with its own NAT Gateway is not centralized. Option C is wrong because Network Load Balancer is not designed for internet egress. Option D is wrong because VPC peering does not scale to hundreds of VPCs and lacks transitive routing.
Variation 3. A company has multiple AWS accounts and wants to centrally manage network security using AWS Network Firewall. The firewall must inspect traffic between VPCs in the same Region. Which deployment model achieves this with minimal latency?
hard
A.Deploy AWS Network Firewall in each VPC and configure VPC peering between VPCs.
B.Deploy AWS Network Firewall in a shared services VPC and use VPC peering to connect all VPCs.
✓ C.Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.
D.Use a centralized inspection VPC with a Gateway Load Balancer and third-party appliances.
Why C: Option D is correct because an AWS Network Firewall in the transit VPC can inspect traffic between VPCs when using Transit Gateway and route tables to steer traffic through the firewall. Option A is wrong because firewall per VPC would not inspect inter-VPC traffic unless routing is configured, and it adds overhead. Option B is wrong because a firewall in each VPC is not centralized. Option C is wrong because the firewall must be in the path of traffic; simply inspecting at the egress point of each VPC would not catch all inter-VPC traffic.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.