ANS-C01 Network Implementation Practice Question
A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a subnet that hosts a web application. They need to ensure that traffic from the on-premises network to the web application does not traverse the internet. Which TWO components are required? (Select TWO.)
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a Site-to-Site VPN can provide private connectivity, but the trap here is that VPNs still traverse the public internet (even if encrypted), whereas Direct Connect provides a dedicated private path that avoids internet transit entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Direct Connect Gateway associated with the Transit Gateway
A Direct Connect Gateway associated with the Transit Gateway allows traffic from on-premises networks to reach VPCs attached to the Transit Gateway without traversing the internet. This association enables the Transit Gateway to route traffic between Direct Connect virtual interfaces and VPC attachments using private IP addresses, ensuring the path remains over the AWS private network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Internet Gateway attached to the VPC
Why it's wrong here
Internet Gateway is for internet access, not private connectivity.
- ✓
Direct Connect Gateway associated with the Transit Gateway
Why this is correct
This allows the Direct Connect connection to be propagated to the Transit Gateway.
- ✓
Direct Connect private virtual interface attached to a Direct Connect Gateway
Why this is correct
This provides a dedicated connection without internet.
- ✗
Site-to-Site VPN connection to the Transit Gateway
Why it's wrong here
VPN uses the internet; the requirement is to avoid the internet.
- ✗
CloudFront distribution in front of the web application
Why it's wrong here
CloudFront is a CDN and does not provide private connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to securely connect multiple VPCs in the same region to a common on-premises network using a single Direct Connect connection. Which AWS service should they use to simplify the network architecture?
easy- A.Virtual Private Gateway
- ✓ B.Direct Connect Gateway
- C.VPC Peering
- D.Transit Gateway
Why B: A Direct Connect Gateway allows you to associate multiple VPCs (in the same or different AWS regions) with a single AWS Direct Connect connection, enabling connectivity to a common on-premises network. This simplifies the architecture by eliminating the need for multiple virtual interfaces or separate Direct Connect connections per VPC. The Direct Connect Gateway acts as a hub that routes traffic between the on-premises network and all associated VPCs via a single private virtual interface (VIF).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.