ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. They want to ensure that traffic between VPCs is inspected by a third-party firewall appliance deployed in a centralized inspection VPC. Which THREE steps are required? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.
The firewall appliance must be configured for stateful inspection and to route traffic back to the Transit Gateway. Option C is correct because separate Transit Gateway route tables must be created to propagate routes from the inspection VPC and associate them with the spoke VPC attachments, ensuring traffic is directed to the inspection VPC. Option E is correct because the inspection VPC must be attached to the Transit Gateway to receive and forward traffic. Option B is incorrect because Transit Gateway replaces VPC peering; peering is not used. Option D is incorrect because Direct Connect is not required; the existing VPN connection handles on-premises connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the firewall appliance to perform stateful inspection and route traffic back to the Transit Gateway.
Why this is correct
Correct: Firewall must inspect and forward traffic.
- ✗
Set up VPC peering between the inspection VPC and each spoke VPC.
Why it's wrong here
Wrong: Transit Gateway handles connectivity, not VPC peering.
- ✓
Create Transit Gateway route tables that propagate routes from the inspection VPC and associate them with the other VPC attachments.
Why this is correct
Correct: Route tables direct traffic to inspection VPC.
- ✗
Establish an AWS Direct Connect connection between the inspection VPC and the on-premises network.
Why it's wrong here
Wrong: Direct Connect is not required for traffic inspection.
- ✓
Attach the inspection VPC to the Transit Gateway.
Why this is correct
Correct: Attachment is necessary for traffic flow.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.