ANS-C01 Network Security, Compliance and Governance Practice Question

Correct answer & explanation

Creating static routes in each VPC's transit gateway route table pointing to the inspection VPC attachment for all destination CIDRs, and removing any routes that point directly to other attachments, ensures that all traffic is sent to the inspection VPC. Without static routes, propagated routes from the inspection VPC attachment create routes to the inspection VPC, but other attachments may also propagate routes that allow direct communication, bypassing inspection. Option A is incorrect because enabling route propagation alone does not force traffic through the inspection VPC; it only adds routes automatically, but other routes (e.g., from Direct Connect or VPN attachments) can still allow direct paths. Option C is incorrect because network ACLs in the inspection VPC control traffic to and from its subnets but do not influence routing decisions in the transit gateway; they cannot prevent traffic from bypassing the inspection VPC. Option D is incorrect because VPC peering connections bypass the transit gateway entirely, so traffic would not be inspected by the Network Firewall in the inspection VPC.