ANS-C01 Network Management and Operations Practice Question
A financial company has a multi-account AWS environment using AWS Organizations. They have deployed a centralized inspection VPC with a third-party firewall appliance. All VPCs are attached to a Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by the firewall. The firewall is deployed in an Auto Scaling group behind a Network Load Balancer (NLB). What is the BEST way to route traffic to the firewall?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.
The best approach. By creating a Transit Gateway attachment in the inspection VPC and configuring the Network Load Balancer (NLB) as the target, all inter-VPC traffic can be routed through the firewall via Transit Gateway route tables. This ensures centralized inspection without introducing complexity. Option A is incorrect because a Gateway Load Balancer (GWLB) is not needed here; the NLB already provides load balancing for the firewall instances. Option B is incorrect because VPC peering bypasses the Transit Gateway, defeating centralized inspection. Option C is incorrect because deploying a firewall in each VPC is not centralized and increases management overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a Gateway Load Balancer (GWLB) endpoint in each VPC to route traffic to the firewall.
Why it's wrong here
GWLB is for transparent appliances, but the scenario uses NLB.
- ✗
Use VPC peering between each VPC and the inspection VPC.
Why it's wrong here
Bypasses Transit Gateway and complicates routing.
- ✗
Deploy a firewall appliance in each VPC and route traffic locally.
Why it's wrong here
Not centralized inspection.
- ✓
Create a Transit Gateway attachment in the inspection VPC and point the NLB as the target. Route traffic through the Transit Gateway route tables to the inspection VPC.
Why this is correct
ECMP distributes traffic across firewall instances.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.