ANS-C01 Network Implementation Practice Question
A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via Direct Connect. The network team wants to isolate traffic between VPCs while allowing all VPCs to reach the on-premises network. Which TWO configurations should be implemented?
⚠ Common exam trap
The trap here is thinking that a single route table can isolate VPC traffic or that a Direct Connect virtual interface attaches directly to a Transit Gateway VPN attachment. In reality, separate route tables per VPC combined with route propagation from a Direct Connect gateway are needed to isolate VPCs while providing shared on-premises access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Direct Connect gateway to propagate routes to all VPCs
Creating separate Transit Gateway route tables for each VPC and associating them with the respective VPC attachments enforces traffic isolation between VPCs: each VPC route table only contains routes to the on-premises network, not to other VPCs, thus achieving the isolation requirement. Additionally, using a Direct Connect gateway to propagate routes to all VPCs ensures that the on-premises network routes are available in these isolated route tables. Option A is incorrect because a Direct Connect virtual interface must be attached to a Direct Connect Gateway, which then associates with the Transit Gateway via a transit gateway attachment. A VPN attachment is for VPN connections, not Direct Connect. Option D is incorrect because a single Transit Gateway route table for all attachments would allow VPC-to-VPC communication via automatically propagated routes. Option E is incorrect because VPC peering connections would create direct connectivity between VPCs, violating the isolation requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach the Direct Connect virtual interface to a VPN attachment on the Transit Gateway
Why it's wrong here
This is incorrect because a Direct Connect virtual interface (VIF) is attached to a Direct Connect Gateway, not a VPN attachment on the Transit Gateway. The VPN attachment is used for VPN connections, not Direct Connect. A Direct Connect Gateway must be used to connect the Direct Connect VIF to the Transit Gateway.
- ✓
Use a Direct Connect gateway to propagate routes to all VPCs
Why this is correct
Using a Direct Connect gateway to propagate routes to all VPCs is not a valid configuration for Transit Gateway. The Direct Connect gateway associates with the Transit Gateway, not directly with VPCs.
- ✓
Create separate Transit Gateway route tables for each VPC and associate them with the respective VPC attachments
Why this is correct
This is correct because creating separate Transit Gateway route tables for each VPC and associating them with the respective VPC attachments isolates traffic between VPCs while allowing each VPC to reach the on-premises network via the Transit Gateway attachment to the Direct Connect Gateway.
- ✗
Use a single Transit Gateway route table for all attachments
Why it's wrong here
Would allow VPC-to-VPC traffic.
- ✗
Create VPC peering connections between each VPC
Why it's wrong here
Unnecessary with Transit Gateway.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.