Centralized Traffic Inspection Across Accounts Using Transit Gateway
A company is designing a multi-account AWS environment using AWS Organizations. They need to centralize VPC flow logs and network traffic inspection across all accounts. Which architecture meets these requirements with minimal operational overhead?
Quick Answer
The correct architecture is to deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it. This works because Transit Gateway enables transitive routing between multiple VPCs, allowing you to force all inter-VPC and egress traffic through a single inspection point, while AWS Network Firewall provides centralized, scalable traffic inspection without deploying appliances in every account. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of transitive routing versus VPC peering’s non-transitive nature—a common trap is choosing VPC peering or distributing firewalls per account, which increases operational overhead and breaks centralized inspection. Remember the memory tip: “TGW + NGFW = one-stop shop for traffic cops,” meaning Transit Gateway is the hub, and Network Firewall is the single inspection point, eliminating the need for per-account firewalls or complex peering meshes.
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that VPC peering can replace Transit Gateway for centralized inspection, but VPC peering is non-transitive and requires a full mesh, making it unscalable and operationally heavy — Transit Gateway is the correct service for transitive routing with minimal overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.
It uses a central inspection VPC with AWS Network Firewall and Transit Gateway to route traffic from all VPCs through a single inspection point. This architecture centralizes both VPC flow logs and traffic inspection with minimal operational overhead, as Transit Gateway simplifies network connectivity and AWS Network Firewall provides managed, scalable inspection without per-account firewall management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a central inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic from all VPCs through it.
Why this is correct
Centralized inspection with AWS Network Firewall and Transit Gateway is recommended.
- ✗
Use AWS Network Firewall in each VPC and aggregate logs centrally.
Why it's wrong here
Higher operational overhead than centralised approach.
- ✗
Enable VPC flow logs in each account and send them to a central S3 bucket. Use Network Access Analyzer for inspection.
Why it's wrong here
Flow logs are for monitoring, not inspection; Network Access Analyzer is for auditing, not inline.
- ✗
Create VPC peering connections between all VPCs and deploy a third-party firewall in one VPC.
Why it's wrong here
VPC peering is not transitive, so not all VPCs can route through one.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is setting up a new AWS account and wants to centrally manage VPC network traffic inspection across multiple accounts using a central VPC. The company uses AWS Organizations. Which architecture meets these requirements?
hard- A.Create VPC peering connections between each account's VPC and the central VPC.
- ✓ B.Use AWS Transit Gateway with a central inspection VPC that has firewall appliances.
- C.Use VPC endpoints to route traffic to the central VPC.
- D.Deploy a Network Load Balancer in each VPC and route traffic through it.
Why B: AWS Transit Gateway acts as a hub-and-spoke router, enabling centralized network traffic inspection by routing inter-VPC and VPN traffic through a central inspection VPC that hosts firewall appliances (e.g., third-party NGFWs or AWS Network Firewall). This architecture scales across multiple accounts in AWS Organizations using resource sharing via AWS Resource Access Manager, and it supports granular route tables to force traffic through the inspection VPC without requiring peering mesh or single points of failure.
Variation 2. A company has a multi-account AWS Organizations setup with hundreds of VPCs across multiple regions. The network team needs to centralize outbound internet traffic through a set of inspection VPCs for security monitoring. Which solution is MOST scalable and cost-effective?
hard- A.Use a Network Load Balancer in each VPC to distribute traffic to inspection appliances.
- ✓ B.Create a Transit Gateway with a central inspection VPC that has a NAT Gateway and route all VPCs to the inspection VPC for egress.
- C.Deploy a NAT Gateway in each VPC and route traffic directly to the internet.
- D.Set up VPC peering between all VPCs and route traffic through a single VPC with an Internet Gateway.
Why B: A Transit Gateway with a central inspection VPC centralizes egress traffic through a single NAT Gateway, eliminating the need for per-VPC NAT Gateways. This architecture scales horizontally by attaching hundreds of VPCs to the Transit Gateway and routing all 0.0.0.0/0 traffic to the inspection VPC, which is cost-effective as it reduces NAT Gateway hourly charges and data processing costs across multiple regions.
Variation 3. A company has multiple AWS accounts and wants to centrally manage network security using AWS Network Firewall. The firewall must inspect traffic between VPCs in the same Region. Which deployment model achieves this with minimal latency?
hard- A.Deploy AWS Network Firewall in each VPC and configure VPC peering between VPCs.
- B.Deploy AWS Network Firewall in a shared services VPC and use VPC peering to connect all VPCs.
- ✓ C.Use AWS Transit Gateway and attach AWS Network Firewall as a VPC attachment to the transit gateway.
- D.Use a centralized inspection VPC with a Gateway Load Balancer and third-party appliances.
Why C: AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs route traffic through a central inspection VPC. By attaching AWS Network Firewall as a VPC attachment to the transit gateway, traffic between VPCs is routed through the firewall for inspection with minimal latency because the firewall is deployed inline within the transit gateway route table, avoiding the overhead of multiple peering connections or third-party appliances.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.