Central Traffic Inspection Using AWS Transit Gateway
A company has a VPC with multiple subnets. They want to centrally manage and inspect all traffic between subnets using a security appliance. Which AWS service should be used to achieve this?
Quick Answer
The correct choice is Transit Gateway with a security appliance in a central VPC. This architecture enables centralized traffic inspection by routing all inter-subnet traffic through a middlebox appliance, such as a firewall, deployed in a shared services VPC, allowing you to enforce security policies without point-to-point peering. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of how Transit Gateway acts as a hub for transitive routing and central inspection, often appearing as a trap where VPC peering (point-to-point, not centralized) or AWS Network Firewall (a service, not the architectural glue) are distractors. Remember the key distinction: Transit Gateway provides the network fabric for central inspection, while the security appliance does the actual filtering. Memory tip: think “hub-and-spoke with a firewall in the hub” to instantly recall the correct design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transit Gateway with a security appliance in a central VPC
Transit Gateway with a security appliance in a central VPC (Option D) is the correct approach because it allows centralized inspection of all traffic between subnets by routing traffic through a central inspection VPC where security appliances are deployed. Option A (VPC peering) is incorrect because it only provides direct connectivity between two VPCs and does not support centralized inspection. Option B (AWS Route 53 Resolver) is a DNS service and has no traffic inspection capability. Option C (AWS Network Firewall) is a managed firewall service, but it does not provide the multi-VPC architecture needed to centrally route traffic from multiple subnets/VPCs; Transit Gateway is required to route traffic to the firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC peering
Why it's wrong here
Not centralized.
- ✗
AWS Route 53 Resolver
Why it's wrong here
DNS only.
- ✗
AWS Network Firewall
Why it's wrong here
Can inspect traffic but Transit Gateway is the connectivity hub.
- ✓
Transit Gateway with a security appliance in a central VPC
Why this is correct
Allows centralized inspection.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses a centralized inspection VPC for traffic inspection. All VPCs route traffic to the inspection VPC via Transit Gateway. The security team wants to ensure that all traffic between VPCs is inspected by a network virtual appliance in the inspection VPC. Which Transit Gateway feature should be configured?
medium- A.Transit Gateway flow logs
- B.Transit Gateway multicast
- ✓ C.Transit Gateway route tables
- D.Transit Gateway peering
Why C: To ensure that all traffic between VPCs is inspected by the network virtual appliance in the inspection VPC, you must control the routing. Transit Gateway route tables (Option C) allow you to define which traffic is sent to the inspection VPC by associating attachments with specific route tables and adding static routes or propagating routes. This ensures that inter-VPC traffic is forced through the inspection appliance before reaching its destination. Transit Gateway flow logs (Option A) only provide visibility into traffic but do not enforce inspection; they are a monitoring tool, not a routing mechanism. Therefore, Option C is correct, while Options A, B, and D are incorrect.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.