ANS-C01 Transit Gateway Practice Question
A company is migrating a legacy application to AWS. The application requires that all network traffic between two VPCs be inspected by a third-party firewall appliance. The firewall must be able to inspect traffic bidirectionally and automatically fail over if the appliance becomes unhealthy. Which architecture meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Transit Gateway with a Network Load Balancer in front of multiple firewall appliances
AWS Transit Gateway with a Network Load Balancer (NLB) in front of multiple firewall appliances enables bidirectional traffic inspection and automatic failover. The NLB performs health checks and distributes traffic to healthy firewall instances, ensuring high availability. Option B is wrong because VPC Peering does not support a central inspection point; traffic flows directly between VPCs without passing through a firewall. Option C is wrong because a single firewall instance is a single point of failure, lacking automatic failover. Option D is wrong because AWS PrivateLink uses VPC Endpoints for connectivity, which does not allow traffic inspection by a third-party firewall in the consumer VPC; it only allows one-way initiated connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Transit Gateway with a Network Load Balancer in front of multiple firewall appliances
Why this is correct
Transit Gateway enables centralized routing, and NLB provides health checks and failover.
- ✗
Use VPC Peering between the two VPCs and route traffic through a firewall instance in one of the VPCs
Why it's wrong here
VPC Peering does not allow transitive routing, making central inspection difficult.
- ✗
Deploy a single firewall instance in a shared VPC and route all inter-VPC traffic through it
Why it's wrong here
A single instance is a single point of failure.
- ✗
Use AWS PrivateLink to connect the VPCs and place the firewall in the consumer VPC
Why it's wrong here
PrivateLink is for service access, not for inspecting all inter-VPC traffic.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.