Centralized Internet Egress via Transit Gateway — Configuration Guide
A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The company wants to centralize internet egress for all VPCs through a single VPC that has a NAT Gateway and an internet gateway. Which TWO configurations are required to achieve this?
Quick Answer
The answer is to configure a default route of 0.0.0.0/0 pointing to the Transit Gateway in each non-egress VPC, and a default route of 0.0.0.0/0 pointing to the internet gateway in the egress VPC. This works because centralized internet egress via Transit Gateway funnels all outbound traffic from spoke VPCs into a single egress VPC, where a NAT Gateway translates private IPs before the traffic reaches the internet gateway. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of transitive routing and the distinction between spoke and egress VPC route tables. A common trap is assuming the egress VPC should route 0.0.0.0/0 back to the Transit Gateway, which would create a routing loop; instead, the egress VPC must point directly to the internet gateway. Remember the memory tip: “Spokes point to the hub, the hub points to the internet”—the Transit Gateway is the hub for spoke routes, but the egress VPC itself must bypass the hub for internet-bound traffic.
⚠ Common exam trap
Candidates often think the egress VPC needs a route to the Transit Gateway for 0.0.0.0/0, but this would create a loop; instead, the egress VPC must route directly to the internet gateway, while non-egress VPCs point to the Transit Gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the egress VPC, add a route for 0.0.0.0/0 to the internet gateway in the route table of the subnet containing the NAT Gateway.
The egress VPC must route traffic from the NAT Gateway to the internet gateway for internet-bound traffic. The NAT Gateway resides in a public subnet with a route table that directs 0.0.0.0/0 to the internet gateway, enabling outbound connectivity. This allows the NAT Gateway to translate private IPs from other VPCs and forward traffic to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In the egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.
Why it's wrong here
This would create a routing loop; the egress VPC should not send internet traffic back to Transit Gateway.
- ✗
Create a VPN connection between each VPC and the Transit Gateway.
Why it's wrong here
VPCs are already attached to Transit Gateway; no VPN needed.
- ✓
In the egress VPC, add a route for 0.0.0.0/0 to the internet gateway in the route table of the subnet containing the NAT Gateway.
Why this is correct
This allows the NAT Gateway to reach the internet via the internet gateway.
- ✓
In each non-egress VPC, add a route for 0.0.0.0/0 to the Transit Gateway.
Why this is correct
This sends all internet-bound traffic to the Transit Gateway, which forwards it to the egress VPC.
- ✗
In each non-egress VPC, delete the local route.
Why it's wrong here
The local route (VPC CIDR) is required and cannot be deleted.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Transit Gateway to connect multiple VPCs and on-premises data centers. They want to centralize internet traffic through a single VPC that has an internet gateway. Which Transit Gateway feature should they enable?
medium- ✓ A.Transit Gateway route tables
- B.VPN attachments
- C.Multicast support
- D.IPsec acceleration
Why A: To centralize internet traffic through a single VPC with an internet gateway, you need to control the routing of traffic from other VPCs and on-premises networks. Transit Gateway route tables allow you to isolate or share routes between attachments, enabling you to create a default route (0.0.0.0/0) pointing to the centralized VPC's attachment. This ensures all outbound internet traffic from other VPCs is forwarded to the egress VPC, which then uses its internet gateway.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.