ANS-C01 Transit Gateway Route Tables Practice Question
A financial services company is deploying a multi-account environment using AWS Organizations. The security team requires that all network traffic to and from the internet must flow through a centralized inspection VPC that hosts third-party firewall appliances. The architecture uses a single AWS Transit Gateway with a centralized inspection VPC attached. Which THREE steps are necessary to enforce this architecture? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.
Spoke VPCs need a default route (0.0.0.0/0) pointing to the transit gateway attachment to send internet-bound traffic to the inspection VPC. Option D is correct: in the inspection VPC, traffic from the transit gateway must be routed to the firewall appliances, inspected, and then sent back to the transit gateway for egress to the internet. Option E is correct: separate transit gateway route tables for the inspection VPC and spoke VPCs are required, with appropriate propagation and static routes to enforce traffic flow through the inspection VPC. Option B is incorrect because service control policies (SCPs) can be used to restrict actions in AWS Organizations but do not directly enforce routing; routing is handled via route tables. Option C is incorrect because VPC Gateway Endpoints for S3 and DynamoDB do not affect internet traffic routing; they provide private access to those services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure each VPC's route table with a default route (0.0.0.0/0) pointing to the transit gateway attachment.
Why this is correct
Correct. Spoke VPCs route all internet-bound traffic to the transit gateway, which then forwards it to the inspection VPC.
- ✗
Use AWS Organizations service control policies to prevent direct internet access from spoke VPCs.
Why it's wrong here
Incorrect. Service control policies limit permissions but do not control network routing. Route tables manage traffic flow.
- ✗
Deploy VPC Gateway Endpoints for S3 and DynamoDB in each spoke VPC.
Why it's wrong here
Incorrect. Gateway Endpoints provide private access to S3/DynamoDB, not internet routing. They do not enforce centralized internet traffic.
- ✓
In the inspection VPC, route traffic from the transit gateway to the firewall appliances, then back to the transit gateway for egress.
Why this is correct
Correct. The inspection VPC must route traffic from the transit gateway through firewall appliances for inspection, then back to the transit gateway for egress.
- ✓
Create separate transit gateway route tables for the inspection VPC and spoke VPCs, and propagate routes appropriately.
Why this is correct
Correct. Separate transit gateway route tables allow the inspection VPC to have its own routing, ensuring traffic is forced through the firewall.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.