The answer is that the Transit Gateway route tables allow direct communication between application VPCs. For centralized traffic inspection to work, the Transit Gateway must force all east-west traffic through the inspection VPC by using separate route tables: one for the inspection VPC that contains routes to all other VPCs, and another for the application VPCs that only contains a default route pointing to the inspection VPC. If application VPCs share a route table that includes direct routes to each other, traffic bypasses the Network Firewall entirely. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of Transit Gateway route table isolation and how to architect forced inspection paths. A common trap is assuming that simply having a default route to the Transit Gateway ensures inspection, but without route table segmentation, VPCs can communicate directly. Memory tip: “Separate tables, separate paths—if they share a table, inspection fails.”
ANS-C01 Network Design Practice Question
This ANS-C01 practice question tests your understanding of network design. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Transit Gateway route tables allow direct communication between application VPCs
Option C is correct. For east-west traffic to be inspected, the Transit Gateway must route traffic from one VPC to the inspection VPC, then to the destination VPC. This requires that the route tables in the Transit Gateway are configured so that traffic between VPCs is forced through the inspection VPC. If the application VPCs have a direct route to each other via the Transit Gateway (e.g., a static route or a route in the same route table), traffic will not go through the inspection VPC. The most common cause is that the Transit Gateway route table association allows direct VPC-to-VPC routing. Option A is wrong because Network Firewall can inspect traffic at scale. Option B is wrong because Network Firewall is stateful and can handle return traffic. Option D is wrong because the inspection VPC can have multiple subnets for different traffic types.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The Transit Gateway route tables allow direct communication between application VPCs
Why this is correct
If routes exist for direct VPC-to-VPC traffic, it will bypass inspection.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Network Design — This question tests Network Design — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: The Transit Gateway route tables allow direct communication between application VPCs — Option C is correct. For east-west traffic to be inspected, the Transit Gateway must route traffic from one VPC to the inspection VPC, then to the destination VPC. This requires that the route tables in the Transit Gateway are configured so that traffic between VPCs is forced through the inspection VPC. If the application VPCs have a direct route to each other via the Transit Gateway (e.g., a static route or a route in the same route table), traffic will not go through the inspection VPC. The most common cause is that the Transit Gateway route table association allows direct VPC-to-VPC routing. Option A is wrong because Network Firewall can inspect traffic at scale. Option B is wrong because Network Firewall is stateful and can handle return traffic. Option D is wrong because the inspection VPC can have multiple subnets for different traffic types.
What should I do if I get this ANS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to establish a central inspection VPC for traffic inspection using a Gateway Load Balancer (GWLB). Traffic from all other VPCs should be routed through the inspection VPC before reaching the internet or on-premises. Which architecture should be used?
hard
A.Use VPC Peering to connect all VPCs to the inspection VPC and configure routes to the GWLB.
B.Use AWS Direct Connect Gateway to connect all VPCs and route traffic through the inspection VPC.
✓ C.Use AWS Transit Gateway with a centralized inspection VPC that hosts a GWLB. Configure route tables on the Transit Gateway to send traffic to the GWLB endpoint.
D.Use AWS Network Firewall in each VPC and route traffic to it.
Why C: Option C is correct because AWS Transit Gateway enables centralized routing between multiple VPCs, and when combined with a Gateway Load Balancer (GWLB) in an inspection VPC, it allows traffic from all other VPCs to be forwarded to the GWLB for inspection before reaching the internet or on-premises. Transit Gateway route tables can be configured with static routes pointing to the GWLB endpoint (using Gateway Load Balancer Endpoint service), ensuring all inter-VPC and egress traffic is steered through the inspection VPC. This architecture scales efficiently across many VPCs in an AWS Organizations multi-account setup without requiring complex peering or direct connections.
Variation 2. A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?
hard
A.VPC peering between all VPCs and the inspection VPC.
B.AWS Network Firewall deployed in each VPC.
✓ C.AWS Transit Gateway with centralized routing to the inspection VPC.
D.AWS Direct Connect Gateway with virtual interfaces.
Why C: Option C is correct because AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.
Variation 3. A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)
hard
A.Create a VPC peering connection between each spoke VPC and the central VPC.
✓ B.Create a Transit Gateway in the central account and attach the central VPC.
✓ C.Accept the Transit Gateway share in each spoke account and attach their VPCs.
D.Deploy a firewall appliance in each spoke VPC.
✓ E.Use AWS Resource Access Manager to share the Transit Gateway with spoke accounts.
Why B: Option B is correct because a Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.