The answer is to attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance. This works because Transit Gateway acts as a central hub for routing between VPCs, and by attaching the firewall to a dedicated inspection VPC or directly as a transit gateway attachment, you can create specific route table entries that force all inter-VPC traffic through the appliance for centralized traffic inspection. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of Transit Gateway route tables and how to implement a centralized inspection architecture without complex peering or additional load balancers. A common trap is confusing this with VPC endpoints or Network Load Balancers, which do not perform packet inspection. Remember the key: Transit Gateway route tables are the control plane for directing traffic, not the firewall itself. Memory tip: think of the Transit Gateway as a router and the firewall as a next-hop — just set the route table to point all inter-VPC traffic to that next-hop attachment.
ANS-C01 Network Design Practice Question
This ANS-C01 practice question tests your understanding of network design. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has multiple VPCs connected via AWS Transit Gateway. They need to inspect all inter-VPC traffic using a centralized firewall appliance. What is the most efficient way to achieve this?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance
Option B is correct because Transit Gateway supports route tables and attachments; you can attach the firewall appliance to a Transit Gateway and create a blackhole route or use the appliance as a route target. Option A is wrong because VPC endpoints are for accessing AWS services. Option C is wrong because Network Load Balancer does not inspect traffic. Option D is wrong because VPC Flow Logs only log traffic metadata.
Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance
Why this is correct
This centralizes inspection by routing inter-VPC traffic through the firewall appliance.
Related concept
Static NAT maps one inside address to one outside address.
✗
Enable VPC Flow Logs and analyze traffic patterns
Why it's wrong here
Flow Logs only provide logs, not active traffic inspection.
✗
Create VPC Gateway Endpoints for each VPC and route traffic through them
Why it's wrong here
Gateway Endpoints are only for S3 and DynamoDB, not for traffic inspection.
✗
Use a Network Load Balancer to distribute traffic to the firewall appliance
Why it's wrong here
NLB does not inspect traffic; it only load balances.
Common exam traps
Common exam trap: NAT rules depend on direction and matching traffic
NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.
Detailed technical explanation
How to think about this question
NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.
KKey Concepts to Remember
Static NAT maps one inside address to one outside address.
PAT allows many inside hosts to share one public address using ports.
Inside local and inside global describe the private and translated addresses.
NAT ACLs identify traffic for translation, not always security filtering.
TExam Day Tips
→Identify inside and outside interfaces first.
→Check whether the scenario needs static NAT, dynamic NAT or PAT.
→Do not confuse NAT matching ACLs with normal packet-filtering intent.
Key takeaway
NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related ANS-C01 NAT questions on configuration and troubleshooting.
Network Design — This question tests Network Design — Static NAT maps one inside address to one outside address..
What is the correct answer to this question?
The correct answer is: Attach the firewall appliance to the Transit Gateway and configure Transit Gateway route tables to send traffic to the appliance — Option B is correct because Transit Gateway supports route tables and attachments; you can attach the firewall appliance to a Transit Gateway and create a blackhole route or use the appliance as a route target. Option A is wrong because VPC endpoints are for accessing AWS services. Option C is wrong because Network Load Balancer does not inspect traffic. Option D is wrong because VPC Flow Logs only log traffic metadata.
What should I do if I get this ANS-C01 question wrong?
Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related ANS-C01 NAT questions on configuration and troubleshooting.
What is the key concept behind this question?
Static NAT maps one inside address to one outside address.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. They need to ensure that traffic between VPCs is inspected by a centralized security appliance. How should they design the routing?
easy
A.Use Network ACLs on the subnets to restrict traffic and allow inspection.
B.Create VPC peering connections between all VPCs and route traffic through a security appliance in a central VPC.
C.Use security groups on the security appliance to inspect traffic.
✓ D.Create a Transit Gateway with separate route tables. Attach each VPC and the Direct Connect virtual interface to the Transit Gateway. In the route tables, propagate routes and add static routes to send inter-VPC traffic to the security appliance VPC.
Why D: Option D is correct because AWS Transit Gateway supports separate route tables, allowing you to isolate traffic domains. By attaching each VPC and the Direct Connect virtual interface to the Transit Gateway, you can create a centralized inspection VPC. Static routes in the Transit Gateway route tables direct inter-VPC traffic to the security appliance VPC, ensuring all traffic between VPCs is inspected before reaching its destination.
Variation 2. A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. They need to ensure that traffic between VPCs is inspected by a network virtual appliance. Which architecture should they use?
easy
A.Use a Network Load Balancer in each VPC to forward traffic to the appliance.
B.Attach the appliance directly to each VPC using VPC Peering.
✓ C.Create an inspection VPC with the appliance. Configure Transit Gateway route tables to send inter-VPC traffic to the inspection VPC attachment.
D.Place the appliance in each VPC and configure VPC Peering.
Why C: Option C is correct because it uses an inspection VPC as a central point for traffic inspection. By attaching the network virtual appliance to a dedicated inspection VPC and configuring Transit Gateway route tables to route inter-VPC traffic to that attachment, all traffic between VPCs is forced through the appliance for inspection. This leverages Transit Gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without complex peering or per-VPC appliance deployments.
Variation 3. A company wants to connect two VPCs in the same AWS region using a hub-and-spoke model. Which AWS service should be used to route traffic between the VPCs through a central inspection VPC?
easy
A.AWS Direct Connect
✓ B.AWS Transit Gateway
C.AWS VPN CloudHub
D.VPC Peering
Why B: Option C is correct because AWS Transit Gateway provides a hub-and-spoke model for connecting multiple VPCs, with centralized routing and inspection capabilities. Option A is wrong because VPC Peering does not allow transitive routing; each peering connection is a one-to-one relationship. Option B is wrong because AWS Direct Connect is for on-premises connectivity, not VPC-to-VPC. Option D is wrong because AWS VPN CloudHub is for connecting multiple VPN connections.
Variation 4. A company is designing a global network with multiple VPCs connected via AWS Transit Gateway. The company wants to route traffic between VPCs through a centralized inspection VPC that hosts firewalls. Which configurations are required? (Choose THREE.)
hard
✓ A.Configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment.
B.Create VPC endpoints for the inspection services.
✓ C.Add static routes in the Transit Gateway route tables for VPC attachments.
✓ D.Propagate VPC attachment routes to a dedicated route table.
E.Establish VPC peering connections between each VPC and the inspection VPC.
Why A: Option A is correct because configuring a default route (0.0.0.0/0) in the Transit Gateway route table pointing to the inspection VPC attachment forces all inter-VPC traffic that does not match a more specific route to be sent to the inspection VPC for firewall inspection. This is a common pattern for centralized inspection, where the inspection VPC acts as a next hop for all traffic between VPCs.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.