ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Site-to-Site VPN. The security team wants to inspect all traffic between VPCs using a centralized inspection VPC with third-party firewall appliances. Which architecture ensures that traffic from VPC A to VPC B is routed through the inspection VPC?
⚠ Common exam trap
The trap here is assuming that simply attaching all VPCs to a Transit Gateway automatically routes traffic through a centralized inspection VPC, when in fact you must explicitly configure separate route tables and static routes to force traffic through the inspection VPC, otherwise Transit Gateway uses its default route table for direct attachment-to-attachment routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.
It uses separate Transit Gateway route tables to isolate the inspection VPC and other VPCs. By configuring the route table for VPC A to point to VPC B's CIDR via the inspection VPC attachment, all inter-VPC traffic is forced through the centralized firewall appliances. This leverages Transit Gateway's ability to route traffic between attachments based on route table associations and propagations, ensuring traffic flows through the inspection VPC without requiring VPC peering or additional per-VPC firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach all VPCs to a Transit Gateway. Create separate route tables: one for inspection VPC attachments and one for others. In VPC A's route table, route to VPC B via the inspection VPC attachment.
Why this is correct
This design uses Transit Gateway route tables to force traffic through the inspection VPC.
- ✗
Create a VPC peering connection between VPC A and VPC B, and attach firewall appliances in both VPCs.
Why it's wrong here
VPC peering does not support transitive routing; traffic would go directly.
- ✗
Use AWS PrivateLink to create VPC endpoints in VPC A and VPC B, and route traffic through the firewall VPC.
Why it's wrong here
PrivateLink is for accessing services, not for routing VPC-to-VPC traffic.
- ✗
Deploy AWS Network Firewall in each VPC and configure VPC route tables to send traffic to the firewall endpoint.
Why it's wrong here
This is a valid approach but does not use Transit Gateway as specified.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized security appliance running in a security VPC. Which configuration should be used?
medium- A.Configure network ACLs in each VPC to deny traffic directly between VPCs.
- ✓ B.Attach the VPCs to the Transit Gateway and configure route tables to send inter-VPC traffic to the security VPC via a route pointing to the security VPC's attachment.
- C.Create VPC peering connections between each VPC and the security VPC, then update route tables.
- D.Use NAT gateways in each VPC to route traffic through the security VPC.
Why B: AWS Transit Gateway enables centralized traffic inspection by attaching VPCs and configuring route tables to route inter-VPC traffic to the security VPC's attachment. Note that the route must point to the security VPC attachment, not a blackhole route (which drops traffic). Option A is incorrect because network ACLs control traffic at the subnet level and cannot route traffic to another VPC. Option C is incorrect because VPC peering does not provide a centralized inspection point without complex routing. Option D is incorrect because NAT gateways are for outbound internet traffic, not inter-VPC inspection.
Variation 2. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to ensure that traffic between VPCs is inspected by a centralized firewall appliance in a inspection VPC. Which architecture meets this requirement?
hard- A.Create VPC peering connections between all VPCs and route traffic through the inspection VPC.
- B.Deploy AWS Network Firewall in each VPC and allow traffic to flow directly between VPCs.
- ✓ C.Attach all VPCs to a Transit Gateway and create separate route tables for inspection.
- D.Use AWS Direct Connect Gateway to route traffic between VPCs through the inspection VPC.
Why C: Transit Gateway route tables can direct traffic between VPCs through a central inspection VPC by using route propagation and appropriate route table associations. Option A is wrong because VPC peering does not support transitive routing; traffic would need to traverse multiple non-transitive connections, and peering alone cannot force traffic through a centralized firewall. Option B is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; traffic between VPCs would flow directly unless routing forces it through the firewall, which is not described. Option D is wrong because AWS Direct Connect Gateway is used for connecting on-premises networks to AWS, not for routing traffic between VPCs through an inspection VPC.
Variation 3. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a security appliance in a centralized inspection VPC. How should they configure the Transit Gateway route tables?
hard- A.Create a route table for the inspection VPC and add blackhole routes for all other VPCs
- B.Use one route table with all VPC attachments and enable route propagation for all attachments
- C.Create separate route tables for each VPC and add a static route to the inspection VPC
- ✓ D.Associate all VPCs with a single route table that has a default route pointing to the inspection VPC attachment, and enable route propagation from the inspection VPC
Why D: Using separate route tables for each VPC with a blackhole route pointing to the inspection VPC is not standard; the correct approach is to have a shared route table that propagates routes and uses a static route to the inspection VPC. Option D is correct: associate all VPCs with a single route table that has a default route pointing to the inspection VPC's attachment, and enable route propagation from the inspection VPC. Option A is wrong because it does not force traffic through the inspection VPC. Option B is wrong because it only inspects traffic from one VPC. Option C is wrong because a blackhole route drops traffic.
Variation 4. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)
hard- ✓ A.Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.
- B.Set up VPC peering between the inspection VPC and each spoke VPC.
- ✓ C.Create Transit Gateway route tables that propagate routes from the inspection VPC and associate them with the other VPC attachments.
- D.Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.
- ✓ E.Attach the inspection VPC to the Transit Gateway.
Why A: The firewall appliance must be configured for stateful inspection and to route traffic back to the Transit Gateway. Option C is correct because separate Transit Gateway route tables must be created to propagate routes from the inspection VPC and associate them with the spoke VPC attachments, ensuring traffic is directed to the inspection VPC. Option E is correct because the inspection VPC must be attached to the Transit Gateway to receive and forward traffic. Option B is incorrect because Transit Gateway replaces VPC peering; peering is not used. Option D is incorrect because Direct Connect is not required; the existing VPN connection handles on-premises connectivity.
Variation 5. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team needs to inspect all traffic between VPCs and on-premises using a centralized firewall appliance. Which architecture meets this requirement?
medium- A.Deploy AWS Network Firewall in each VPC and route all traffic through it.
- B.Connect all VPCs to on-premises via AWS Direct Connect and inspect traffic on-premises.
- C.Create VPC peering connections between each VPC and the firewall VPC.
- ✓ D.Use Transit Gateway with a central inspection VPC that hosts the firewall appliance.
Why D: A Transit Gateway with a centralized inspection VPC allows routing all traffic through firewall appliances for centralized inspection. Option A is wrong because deploying AWS Network Firewall in each VPC does not centralize inspection; it distributes inspection per VPC. Option B is wrong because connecting all VPCs to on-premises via Direct Connect does not provide centralized inspection within AWS; it sends traffic on-premises, which may not be desired. Option C is wrong because VPC peering does not support transitive routing, making it unsuitable for centralized inspection across many VPCs.
Variation 6. A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a security requirement that all traffic between VPCs must be inspected by a third-party firewall deployed in a central inspection VPC. The Transit Gateway has route tables configured with blackhole routes for inter-VPC traffic, and the inspection VPC has the firewall. However, traffic is not being inspected; it is being dropped. What is the MOST likely cause?
hard- A.The inspection VPC is not propagating its routes to the Transit Gateway.
- B.The firewall appliance is not configured to forward traffic back to the Transit Gateway.
- C.The Transit Gateway route tables do not have static routes for the inspection VPC.
- ✓ D.The Transit Gateway route table for inter-VPC traffic has blackhole routes instead of pointing to the inspection VPC attachment.
Why D: Blackhole routes in the Transit Gateway route table for inter-VPC traffic cause packets to be dropped before they can be forwarded to the inspection VPC attachment. To enable traffic inspection, the route table must have a route pointing to the inspection VPC attachment instead of a blackhole. Option A is incorrect because route propagation from the inspection VPC determines whether the inspection VPC can reach other VPCs, but it does not cause inter-VPC traffic to be dropped; the blackhole is the direct cause. Option B is incorrect because the firewall not forwarding traffic back would affect return traffic after inspection, but traffic is dropped before ever reaching the firewall. Option C is incorrect because static routes for the inspection VPC are not the primary issue; the route table for inter-VPC traffic already has blackhole routes, which take precedence and drop traffic regardless of static routes.
Variation 7. A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via a VPN. They want to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the network?
medium- A.Create VPC Peering connections between each VPC and the inspection VPC.
- ✓ B.Configure Transit Gateway with appliance mode and route traffic through a dedicated inspection VPC.
- C.Use security groups in each VPC to restrict traffic and enable VPC Flow Logs for auditing.
- D.Place the security appliance in each VPC and use Network Firewall to inspect traffic.
Why B: Transit Gateway supports appliance mode that forces traffic to be routed through a dedicated inspection VPC where a centralized security appliance resides. Option A is wrong because VPC peering does not support transitive routing; each VPC would need individual peering connections, and traffic cannot be centrally inspected. Option C is wrong because security groups only provide stateful filtering at the instance level and do not inspect all traffic between VPCs; VPC Flow Logs are for logging, not inspection. Option D is wrong because placing the security appliance in each VPC creates a distributed model, not centralized; Network Firewall can be used with Transit Gateway for centralized inspection but the option implies per-VPC appliances, which is not the design requested.
Variation 8. A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to centrally inspect and filter traffic between VPCs using a third-party firewall appliance. Which architecture should be used?
easy- A.AWS PrivateLink endpoints in each VPC
- B.AWS Network Firewall deployed in each VPC
- C.VPC peering between each VPC and the inspection VPC
- ✓ D.Transit Gateway with appliance mode and a dedicated inspection VPC
Why D: Transit Gateway with appliance mode and a dedicated inspection VPC is the correct architecture because it enables symmetric routing, forcing traffic through the inspection VPC for centralized inspection. Option A (AWS PrivateLink) is incorrect; PrivateLink provides private connectivity to services, not traffic inspection between VPCs. Option B (AWS Network Firewall in each VPC) is incorrect because deploying a firewall in each VPC is distributed, not centralized, and does not leverage Transit Gateway. Option C (VPC peering) is incorrect because VPC peering does not support transitive routing; peering each VPC to an inspection VPC would be complex and does not take advantage of Transit Gateway's centralized routing capabilities.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.