ANS-C01 Network Security, Compliance and Governance Practice Question
A company is designing a network security architecture for a multi-account environment using AWS Transit Gateway. The company requires that all traffic between VPCs must be inspected by a centralized security appliance in a shared services VPC. The security appliance must receive traffic for both directions (ingress and egress). Which THREE components are required to achieve this? (Choose THREE.)
⚠ Common exam trap
AWS often tests the misconception that VPC peering can be used for transitive routing in a hub-and-spoke model, but the trap here is that VPC peering does not support transitive routing, so it cannot replace Transit Gateway attachments for centralized inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A shared services VPC containing the security appliances.
The shared services VPC hosts the centralized security appliances (e.g., firewalls, intrusion detection systems) that must inspect all inter-VPC traffic. This VPC acts as a hub for traffic inspection, ensuring that both ingress and egress traffic flows through the appliances before reaching its destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A shared services VPC containing the security appliances.
Why this is correct
Centralized inspection point.
- ✓
VPC attachments to the Transit Gateway for each VPC.
Why this is correct
Required for connectivity.
- ✗
VPC peering connections between each spoke VPC and the shared services VPC.
Why it's wrong here
VPC peering does not support transitive routing.
- ✓
Transit Gateway route tables that route traffic between VPCs through the security appliances.
Why this is correct
Enforces inspection.
- ✗
NAT gateways in each spoke VPC for outbound traffic.
Why it's wrong here
Not required for inter-VPC inspection.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.