ANS-C01 Transit Gateway Route Tables Practice Question
A company uses a centralized inspection VPC for traffic inspection. All VPCs route traffic to the inspection VPC via Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by a network virtual appliance in the inspection VPC. Which Transit Gateway feature should be configured?
⚠ Common exam trap
Candidates often confuse monitoring with enforcement. Flow logs show what traffic passes through, but they do not force traffic to go where you want. To actually enforce inspection, you need proper routing configuration via route tables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transit Gateway route tables
To ensure that all traffic between VPCs is inspected by the network virtual appliance in the inspection VPC, you must control the routing. Transit Gateway route tables (Option C) allow you to define which traffic is sent to the inspection VPC by associating attachments with specific route tables and adding static routes or propagating routes. This ensures that inter-VPC traffic is forced through the inspection appliance before reaching its destination. Transit Gateway flow logs (Option A) only provide visibility into traffic but do not enforce inspection; they are a monitoring tool, not a routing mechanism. Therefore, Option C is correct, while Options A, B, and D are incorrect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transit Gateway flow logs
Why it's wrong here
Transit Gateway flow logs provide monitoring and logging of traffic but do not enforce routing. They cannot ensure traffic is inspected; they only help verify inspection after it is configured.
- ✗
Transit Gateway multicast
Why it's wrong here
Transit Gateway multicast handles multicast traffic and is not relevant for ensuring all unicast inter-VPC traffic goes through inspection.
- ✓
Transit Gateway route tables
Why this is correct
Transit Gateway route tables allow you to control routing between attachments. By configuring route tables to send traffic to the inspection VPC's attachment, you enforce that all inter-VPC traffic is inspected.
- ✗
Transit Gateway peering
Why it's wrong here
Transit Gateway peering connects two transit gateways, typically for cross-account or cross-region connectivity, and does not enforce inspection within a single transit gateway.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.