AWS Transit Gateway: Routing Traffic to a Centralized Inspection VPC
A company is using AWS Transit Gateway to connect multiple VPCs. The security team wants to inspect all traffic between VPCs with a third-party firewall appliance deployed in a centralized inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?
Quick Answer
The answer is to configure Transit Gateway route tables with a blackhole route for inter-VPC traffic and a route pointing to the inspection VPC. This works because Transit Gateway route tables allow you to explicitly control traffic flow between attachments; by creating a blackhole entry for the destination VPC CIDRs, you prevent direct communication, and then a more specific route directs that traffic to the inspection VPC attachment, forcing all inter-VPC traffic through the third-party firewall. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of centralized inspection architectures and the transitive routing limitations of VPC peering—a common trap is assuming a Network Load Balancer or PrivateLink can handle inspection, but they lack the packet-level forwarding needed for stateful firewalls. Remember the key insight: blackhole routes act as a deliberate “no direct path,” forcing traffic through the inspection appliance, much like a security checkpoint at an airport where all passengers must pass through a single gate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Transit Gateway route tables with a blackhole route for the inter-VPC traffic and a route pointing to the inspection VPC.
By configuring Transit Gateway route tables with a blackhole route for inter-VPC traffic and a more specific route pointing to the inspection VPC, traffic between VPCs is forced to go through the inspection VPC for firewall inspection. Option A is wrong because VPC peering does not support transitive routing and would require full mesh. Option B is wrong because AWS PrivateLink is used for private connectivity to services, not for routing traffic between VPCs. Option D is wrong because a Network Load Balancer is not designed for traffic inspection and would add unnecessary complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create VPC peering connections between all VPCs and route traffic through the inspection VPC.
Why it's wrong here
VPC peering does not support transitive routing; all VPCs would need to be directly peered with the inspection VPC and route tables set up, which is less efficient.
- ✗
Use AWS PrivateLink to route traffic through the inspection VPC.
Why it's wrong here
PrivateLink is used for accessing services across VPCs, not for traffic inspection.
- ✓
Configure Transit Gateway route tables with a blackhole route for the inter-VPC traffic and a route pointing to the inspection VPC.
Why this is correct
This allows traffic between VPCs to be forced through the inspection VPC for firewall inspection.
- ✗
Attach a Network Load Balancer in each VPC and route traffic through it.
Why it's wrong here
NLB does not provide traffic inspection capabilities.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a hybrid network with an AWS Transit Gateway connecting multiple VPCs and an on-premises data center via AWS Direct Connect. The security team requires that all traffic between VPCs must be inspected by a centralized firewall appliance deployed in a security VPC. They have configured a Transit Gateway with a route table that has blackhole routes for all VPC CIDRs except the security VPC, and the security VPC appliance performs inspection and returns traffic to the Transit Gateway. Recently, they added a new VPC for a critical application. After configuration, some traffic from the new VPC to other VPCs is being dropped. The network engineer verifies that the Transit Gateway route table includes a blackhole route for the new VPC's CIDR and that the security VPC's firewall rules allow the traffic. What is the most likely cause of the dropped traffic?
hard- A.The security VPC's network ACLs are blocking return traffic from the firewall appliance back to the Transit Gateway.
- B.The new VPC's route table does not have a default route pointing to the Transit Gateway attachment.
- C.The Transit Gateway route table propagates the new VPC's CIDR, overriding the static blackhole route.
- ✓ D.The Transit Gateway route table does not have a static route pointing to the security VPC attachment for the new VPC's CIDR.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.