ANS-C01 Network Security, Compliance and Governance Practice Question

A security engineer needs to ensure that all internet-bound traffic from a VPC is inspected by a third-party firewall appliance before reaching the internet. The firewall is deployed in a separate VPC. Which AWS service should the engineer use to route traffic from the source VPC to the firewall VPC?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Transit Gateway with a route table that points the default route (0.0.0.0/0) to the firewall VPC attachment.

AWS Transit Gateway enables transitive routing between VPCs. By creating a route table in the Transit Gateway with a default route (0.0.0.0/0) pointing to the firewall VPC attachment, all internet-bound traffic from the source VPC is forwarded to the firewall for inspection before reaching the internet. Option B (VPC Gateway Endpoint) is incorrect because Gateway Endpoints are used for privately accessing AWS services (like S3 or DynamoDB) from a VPC, not for routing traffic to a third-party firewall. Option C (AWS PrivateLink) is incorrect because PrivateLink allows you to access services hosted in other VPCs via Network Load Balancers and ENIs, but it does not provide transitive routing for internet-bound traffic. Option D (VPC Peering) is incorrect because VPC peering connections do not support transitive routing; you cannot route traffic from one VPC through a peered VPC to another destination.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
AWS Transit Gateway with a route table that points the default route (0.0.0.0/0) to the firewall VPC attachment.
Why this is correct
AWS Transit Gateway supports transitive routing between VPCs. By configuring a route table with a default route pointing to the firewall VPC attachment, all internet-bound traffic from the source VPC is routed through the firewall VPC for inspection.
✗
VPC Gateway Endpoint for the firewall service.
Why it's wrong here
VPC Gateway Endpoints are used to privately access AWS services like S3 or DynamoDB, not to route traffic to a third-party firewall in another VPC.
✗
AWS PrivateLink to connect to the firewall service in the other VPC.
Why it's wrong here
AWS PrivateLink enables private connectivity to services hosted in other VPCs via NLB and ENI, but it does not support transitive routing or act as a default gateway for internet-bound traffic.
✗
VPC Peering connection between the two VPCs with a route table entry that sends internet traffic to the peering connection.
Why it's wrong here
VPC Peering does not support transitive routing. You cannot route traffic from one VPC through a peered VPC to an internet gateway. Peering only allows direct communication between the two peered VPCs.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question