The answer is to use a Transit Gateway with a centralized inspection VPC that employs AWS Network Firewall. This architecture is correct because it leverages a hub-and-spoke model where all inter-VPC traffic is routed through a single inspection VPC, allowing the Network Firewall to perform deep packet inspection at scale without complex peering relationships. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this question tests your understanding of centralized traffic inspection architecture and Transit Gateway design patterns, often appearing as a scenario where you must choose between scalable, managed services versus brittle, manual solutions. A common trap is selecting VPC peering, which creates a mesh that doesn’t scale, or a single third-party appliance VPC, which becomes a bottleneck. Memory tip: Think “TGW + NFW” as the “Traffic Gate and Network Fire Wall” for scalable, centralized inspection.
ANS-C01 Network Security, Compliance and Governance Practice Question
This ANS-C01 practice question tests your understanding of network security, compliance and governance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security engineer is designing a network architecture for a multi-account AWS environment using AWS Organizations. The company requires that all inter-VPC traffic be inspected by a centralized firewall appliance. Which solution provides the most scalable and maintainable inspection architecture?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall
Option D is correct because a Transit Gateway with centralized inspection VPC and Network Firewall provides scalable, centralized traffic inspection across many VPCs. Option A is wrong because VPC peering does not scale well and requires complex routing. Option B is wrong because third-party firewall appliances in a single VPC can become a bottleneck and are less scalable. Option C is wrong because Network ACLs are stateless and not suitable for deep packet inspection.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Use a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall
Why this is correct
This provides scalable, centralized traffic inspection with managed firewall service.
Create VPC peering connections between all VPCs and route traffic through a security VPC with a firewall
Why it's wrong here
VPC peering does not scale; a Transit Gateway is more scalable.
✗
Use Network ACLs in each VPC to filter traffic between subnets
Why it's wrong here
Network ACLs are not designed for centralized inspection across VPCs.
✗
Use a Transit Gateway and attach all VPCs to a centralized inspection VPC that hosts a third-party firewall
Why it's wrong here
While Transit Gateway is good, using a third-party firewall adds management overhead; AWS Network Firewall is more integrated.
Common exam traps
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Network Security, Compliance and Governance — This question tests Network Security, Compliance and Governance — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: Use a Transit Gateway with a centralized inspection VPC that uses AWS Network Firewall — Option D is correct because a Transit Gateway with centralized inspection VPC and Network Firewall provides scalable, centralized traffic inspection across many VPCs. Option A is wrong because VPC peering does not scale well and requires complex routing. Option B is wrong because third-party firewall appliances in a single VPC can become a bottleneck and are less scalable. Option C is wrong because Network ACLs are stateless and not suitable for deep packet inspection.
What should I do if I get this ANS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.