ANS-C01 Network Design Practice Question
A network engineer is designing a hybrid network using AWS Transit Gateway with multiple VPCs and an on-premises data center connected via AWS Direct Connect. The VPCs need to communicate with each other and with on-premises, but must isolate development VPCs from production VPCs. What is the MOST scalable and cost-effective approach?
⚠ Common exam trap
Test-takers frequently assume a single Transit Gateway cannot isolate traffic, but AWS Transit Gateway supports multiple route tables per gateway, enabling logical segmentation without separate transit gateways or complex ACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.
A single Transit Gateway with separate route tables allows you to isolate development and production VPCs from each other while sharing a common route table for the Direct Connect attachment to reach on-premises. This design is highly scalable (no mesh of peering connections) and cost-effective (no per-VPN-tunnel charges), leveraging Transit Gateway’s native segmentation and centralized routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single Transit Gateway with one route table for all VPCs and on-premises, and use network ACLs for isolation.
Why it's wrong here
Network ACLs are stateless and harder to manage; Transit Gateway route tables provide better isolation.
- ✗
Create VPC peering connections between all VPCs and a Direct Connect gateway for on-premises connectivity.
Why it's wrong here
VPC peering requires full mesh and does not scale; no isolation granularity.
- ✗
Use a VPN connection from each VPC to on-premises over Direct Connect, and allow VPC communication via VPN.
Why it's wrong here
Using a VPN from each VPC to on-premises over Direct Connect would require managing individual VPN tunnels per VPC, which does not scale as the number of VPCs grows and introduces unnecessary complexity. It is tempting because site-to-site VPN is a standard method for extending on-premises networks into AWS, and would be correct if the requirement were only to connect each VPC individually to the data centre without any inter-VPC routing or isolation enforcement.
- ✓
Use a single Transit Gateway with separate route tables for development and production VPCs, and a shared route table for on-premises attachment.
Why this is correct
Separate route tables enforce isolation; shared table allows on-premises access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.