ANS-C01 Network Design Practice Question
A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a network virtual appliance. Which architecture should they use?
⚠ Common exam trap
AWS often tests the misconception that you can simply attach a virtual appliance to a Transit Gateway and have it automatically inspect all traffic, but the trap here is that you must explicitly configure Transit Gateway route tables to route inter-VPC traffic to the inspection VPC attachment, otherwise traffic will flow directly between VPC attachments without inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.
It uses an inspection VPC as a central point for traffic inspection. By attaching the network virtual appliance to a dedicated inspection VPC and configuring Transit Gateway route tables to route inter-VPC traffic to that attachment, all traffic between VPCs is forced through the appliance for inspection. This leverages Transit Gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without complex peering or per-VPC appliance deployments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a Network Load Balancer in each VPC to forward traffic to the appliance.
Why it's wrong here
Does not provide centralized inspection.
- ✗
Attach the appliance directly to each VPC using VPC Peering.
Why it's wrong here
VPC Peering does not support transitive routing.
- ✓
Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.
Why this is correct
This allows traffic to be routed through the appliance for inspection.
- ✗
Place the appliance in each VPC and configure VPC Peering.
Why it's wrong here
Not scalable.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.