Multi-Account Transit Gateway with Isolation and Centralized Inspection
A company is designing a network architecture for a multi-account AWS environment using AWS Transit Gateway. They need to meet the following requirements: (1) Centralized inspection of traffic between VPCs using a firewall appliance. (2) Isolated development environments that cannot communicate with each other but can access the internet via a centralized NAT gateway. (3) Compliance with PCI DSS for production workloads, requiring encryption in transit between VPCs. Which TWO actions should they take?
Quick Answer
The correct actions are to create separate Transit Gateway route tables for production and development environments and, for development VPCs, add a static route for 0.0.0.0/0 pointing to a NAT Gateway in a shared services VPC. This design achieves multi-account transit gateway isolation by segmenting traffic domains, while the static route enables centralized internet egress without allowing development VPCs to communicate with each other. For centralized inspection, a dedicated inspection VPC with a firewall appliance is attached to the Transit Gateway, and separate route tables force all inter-VPC traffic through that appliance, meeting the encryption in transit requirement for PCI DSS compliance by ensuring traffic passes through a controlled inspection point. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of Transit Gateway route table segmentation and how to enforce traffic flow for both isolation and inspection. A common trap is assuming a single route table can handle both isolation and centralized inspection; remember that separate route tables are the key to enforcing domain boundaries. Memory tip: “Separate tables for separate labels—inspect the middle, isolate the edges.”
⚠ Common exam trap
Candidates often assume VPC Peering or VPNs are simpler solutions for multi-VPC connectivity, but they fail to recognize that Transit Gateway is specifically designed for transitive routing and centralized inspection at scale, and that separate route tables are essential for isolating development environments while sharing a common NAT gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.
It enables centralized traffic inspection by attaching a dedicated inspection VPC with a firewall appliance to the Transit Gateway and using separate route tables to force all inter-VPC traffic through that inspection VPC. This design meets the requirement for centralized inspection without requiring complex peering or VPN configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use VPC Peering for all inter-VPC communication
Why it's wrong here
VPC Peering does not support transitive routing.
- ✓
Create a dedicated inspection VPC with a firewall appliance and attach it to the Transit Gateway. Use Transit Gateway route tables to route traffic from all VPCs through the inspection VPC.
Why this is correct
Provides centralized inspection.
- ✗
Use AWS Site-to-Site VPN between each VPC and a central VPN hub
Why it's wrong here
Site-to-Site VPN is for on-premises, not VPC-to-VPC.
- ✓
Create separate Transit Gateway route tables for production and development environments. For development VPCs, add a static route for 0.0.0.0/0 pointing to a NAT Gateway in a shared services VPC.
Why this is correct
Provides internet access for development VPCs while isolating them.
- ✗
Use AWS Client VPN to connect development VPCs to the production VPC
Why it's wrong here
Client VPN is for remote users, not VPC-to-VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a multi-account architecture using AWS Transit Gateway. They need to isolate development and production environments but allow shared services account access to both. What is the most scalable and secure design?
medium- A.Use a single Transit Gateway and configure separate route tables for each environment, attaching VPCs from each account.
- B.Use a single Transit Gateway with one route table for all environments and implement security groups to isolate traffic.
- ✓ C.Create two Transit Gateways: one for development and one for production. Share the Transit Gateways with the shared services account via AWS Resource Access Manager.
- D.Use VPC Peering between each VPC and the shared services VPC, and set up Internet Gateway for each environment.
Why C: Using two separate Transit Gateways (one for dev, one for prod) provides complete network isolation between environments at the routing layer, while AWS Resource Access Manager (RAM) allows the shared services account to attach its VPC to both Transit Gateways. This design is scalable as each environment can grow independently without route table conflicts, and secure because there is no transitive routing path between dev and prod. A single Transit Gateway with separate route tables (Option A) still shares the same data plane, introducing risk of misconfiguration or route leaks, whereas two Transit Gateways enforce hard isolation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.