Troubleshooting Centralized Traffic Inspection with Transit Gateway
A financial services company has a multi-account AWS environment using AWS Organizations. They have a central security account with AWS Network Firewall and a central inspection VPC. All other VPCs are connected to the inspection VPC via AWS Transit Gateway. The company wants to enforce that all traffic between VPCs (east-west) and traffic to the internet (north-south) passes through the Network Firewall. They have configured the Transit Gateway route tables appropriately. However, they notice that traffic from an application VPC to another application VPC is not being inspected. The network engineer has verified that the application VPCs have a default route to the Transit Gateway, and the Transit Gateway route table has a route for the inspection VPC. What is the most likely reason that east-west traffic is bypassing the Network Firewall?
Quick Answer
The answer is that the Transit Gateway route tables allow direct communication between application VPCs. For centralized traffic inspection to work, the Transit Gateway must force all east-west traffic through the inspection VPC by using separate route tables: one for the inspection VPC that contains routes to all other VPCs, and another for the application VPCs that only contains a default route pointing to the inspection VPC. If application VPCs share a route table that includes direct routes to each other, traffic bypasses the Network Firewall entirely. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of Transit Gateway route table isolation and how to architect forced inspection paths. A common trap is assuming that simply having a default route to the Transit Gateway ensures inspection, but without route table segmentation, VPCs can communicate directly. Memory tip: “Separate tables, separate paths—if they share a table, inspection fails.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Transit Gateway route tables allow direct communication between application VPCs
The most likely reason east-west traffic is bypassing the Network Firewall is that the Transit Gateway route tables allow direct communication between application VPCs. For traffic to be inspected, it must be routed through the inspection VPC. If the application VPCs have routes in the same Transit Gateway route table that point directly to each other (e.g., a static route or a propagated route from the same VPC attachment), traffic will take that direct path and bypass the Network Firewall. Option B is incorrect because the inspection VPC can have subnets for east-west traffic; the issue is routing, not subnet design. Option C is incorrect because Network Firewall can inspect traffic between VPCs at high throughput. Option D is incorrect because Network Firewall is stateful and handles return traffic correctly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Transit Gateway route tables allow direct communication between application VPCs
Why this is correct
If routes exist for direct VPC-to-VPC traffic, it will bypass inspection.
- ✗
The inspection VPC does not have a subnet for east-west traffic
Why it's wrong here
The inspection VPC can be designed to handle all traffic.
- ✗
Network Firewall cannot inspect traffic between VPCs at high throughput
Why it's wrong here
Network Firewall supports high throughput inspection.
- ✗
Network Firewall is not stateful and cannot handle return traffic
Why it's wrong here
Network Firewall is stateful.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a network for a multi-account AWS environment using AWS Organizations. They need to establish a central inspection VPC for traffic inspection using a Gateway Load Balancer (GWLB). Traffic from all other VPCs should be routed through the inspection VPC before reaching the internet or on-premises. Which architecture should be used?
hard- A.Use VPC Peering to connect all VPCs to the inspection VPC and configure routes to the GWLB.
- B.Use AWS Direct Connect Gateway to connect all VPCs and route traffic through the inspection VPC.
- ✓ C.Use AWS Transit Gateway with a centralized inspection VPC that hosts a GWLB. Configure route tables on the Transit Gateway to send traffic to the GWLB endpoint.
- D.Use AWS Network Firewall in each VPC and route traffic to it.
Why C: AWS Transit Gateway enables centralized routing between multiple VPCs, and when combined with a Gateway Load Balancer (GWLB) in an inspection VPC, it allows traffic from all other VPCs to be forwarded to the GWLB for inspection before reaching the internet or on-premises. Transit Gateway route tables can be configured with static routes pointing to the GWLB endpoint (using Gateway Load Balancer Endpoint service), ensuring all inter-VPC and egress traffic is steered through the inspection VPC. This architecture scales efficiently across many VPCs in an AWS Organizations multi-account setup without requiring complex peering or direct connections.
Variation 2. A company designs a multi-account AWS environment using AWS Organizations. The networking team wants a centralized inspection VPC for traffic between VPCs and on-premises. Which architecture ensures that all inter-VPC traffic passes through the inspection VPC?
hard- A.VPC peering between all VPCs and the inspection VPC.
- B.AWS Network Firewall deployed in each VPC.
- ✓ C.AWS Transit Gateway with centralized routing to the inspection VPC.
- D.AWS Direct Connect Gateway with virtual interfaces.
Why C: AWS Transit Gateway enables centralized routing by attaching all VPCs and the on-premises network to a single transit gateway, then configuring route tables to force all inter-VPC traffic through a dedicated inspection VPC appliance (e.g., firewall or NGFW). This ensures traffic flows via the inspection VPC without requiring full-mesh peering or per-VPC firewalls.
Variation 3. A company has a multi-account AWS environment using AWS Organizations. The network team wants to centralize VPC traffic inspection using a Transit Gateway and a firewall appliance in a central account. Which THREE steps are required to implement this design? (Choose THREE.)
hard- A.Create a VPC peering connection between each spoke VPC and the central VPC.
- ✓ B.Create a Transit Gateway in the central account and attach the central VPC.
- ✓ C.Accept the Transit Gateway share in each spoke account and attach their VPCs.
- D.Deploy a firewall appliance in each spoke VPC.
- ✓ E.Use AWS Resource Access Manager to share the Transit Gateway with spoke accounts.
Why B: A Transit Gateway (TGW) in the central account acts as the hub for VPC traffic inspection. Attaching the central VPC (which contains the firewall appliance) to the TGW allows all inter-VPC traffic to be routed through the central inspection VPC, enabling centralized traffic inspection without requiring VPC peering or per-spoke firewalls.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.