ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Transit Gateway to connect multiple VPCs. Security requirements mandate that traffic between VPCs must be inspected by a centralized firewall appliance in a dedicated inspection VPC. What is the MOST efficient way to route traffic to the inspection VPC?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Transit Gateway route tables with blackhole routes for inter-VPC traffic and a default route pointing to the inspection VPC attachment
Configuring Transit Gateway route tables with blackhole routes for inter-VPC traffic forces that traffic to be dropped unless a more specific route exists. By adding a default route pointing to the inspection VPC attachment, all inter-VPC traffic is routed through the inspection VPC for centralized firewall inspection. This approach is efficient and scalable. Option A is incorrect because deploying AWS Network Firewall in each VPC distributes inspection and does not centralize it. Option B is incorrect because Transit Gateway multicast is designed for one-to-many data replication, not for routing traffic through a central inspection point. Option D is incorrect because VPC peering connections do not provide centralized routing control and do not scale well as the number of VPCs increases.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy AWS Network Firewall in each VPC and configure central logging
Why it's wrong here
This is incorrect because deploying AWS Network Firewall in each VPC decentralizes inspection, contrary to the requirement for centralized inspection. It also adds complexity and cost without leveraging Transit Gateway's routing capabilities.
- ✗
Use Transit Gateway multicast to replicate traffic to the inspection VPC
Why it's wrong here
This is incorrect because Transit Gateway multicast is used for delivering identical data to multiple receivers, not for routing traffic through a centralized firewall for inspection.
- ✓
Configure Transit Gateway route tables with blackhole routes for inter-VPC traffic and a default route pointing to the inspection VPC attachment
Why this is correct
This is correct because using blackhole routes in Transit Gateway route tables blocks direct inter-VPC communication, and a default route to the inspection VPC attachment ensures all traffic between VPCs is sent through the inspection VPC for centralized inspection.
- ✗
Create VPC peering connections between all VPCs and the inspection VPC, then configure route tables to send traffic through the peering connection
Why it's wrong here
Using VPC peering for all-to-inspection-VPC traffic would require managing a full mesh of peering connections, which does not scale efficiently and lacks centralised routing control. This fails the scenario because Transit Gateway already provides a single hub for transitive routing, making peering redundant and operationally heavier. The approach is tempting because VPC peering is a straightforward, low-latency method for direct VPC-to-VPC connectivity, and would be correct for a small, static environment without a centralised inspection requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.