ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to inspect all traffic between VPCs and on-premises using a centralized firewall appliance. Which architecture meets this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Transit Gateway with a central inspection VPC that hosts the firewall appliance.
A Transit Gateway with a centralized inspection VPC allows routing all traffic through firewall appliances for centralized inspection. Option A is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; it distributes inspection per VPC. Option B is wrong because connecting all VPCs to on-premises via Direct Connect does not provide centralized inspection within AWS; it sends traffic on-premises, which may not be desired. Option C is wrong because VPC peering does not support transitive routing, making it unsuitable for centralized inspection across many VPCs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy AWS Network Firewall in each VPC and route all traffic through it.
Why it's wrong here
Not centralized; each VPC has its own firewall.
- ✗
Connect all VPCs to on-premises via AWS Direct Connect and inspect traffic on-premises.
Why it's wrong here
Inspection is on-premises, not in AWS.
- ✗
Create VPC peering connections between each VPC and the firewall VPC.
Why it's wrong here
Complex, not scalable, and does not centralize.
- ✓
Use Transit Gateway with a central inspection VPC that hosts the firewall appliance.
Why this is correct
Centralized inspection via Transit Gateway route tables.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.