SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?
⚠ Common exam trap
Watch out — candidates often assume VPC peering (Option C) can be used for transitive routing, but VPC peering does not support transitive routing, making it impossible to route traffic through an inspection VPC to other VPCs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.
It uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS PrivateLink to route traffic through the NGFW.
Why it's wrong here
PrivateLink is for accessing services, not for traffic inspection.
- ✓
Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.
Why this is correct
This forces all inter-VPC traffic to go through the inspection VPC.
- ✗
Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.
Why it's wrong here
VPC peering does not support transitive routing; each pair needs a separate peering.
- ✗
Set up AWS Direct Connect between all VPCs and the inspection VPC.
Why it's wrong here
Direct Connect is for on-premises, not for VPC-to-VPC routing.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?
hard- ✓ A.Attach the VPCs in member accounts to the transit gateway.
- ✓ B.Update the route tables of the VPCs to point to the transit gateway for inter-VPC traffic.
- C.Create VPC endpoints for the transit gateway in each VPC.
- D.Create VPC peering connections between each VPC and the networking VPC.
- ✓ E.Share the transit gateway with the member accounts using AWS Resource Access Manager.
Why A: Option A is correct because each VPC that must send traffic through the transit gateway needs a transit gateway attachment in its own account (or a shared attachment), which is created by attaching the VPC to the transit gateway. Option B is correct because the VPC route tables must contain routes that direct inter-VPC traffic (for example, the remote VPC CIDR) to the transit gateway attachment; without these routes, traffic will not be forwarded to the transit gateway. Option E is correct because AWS Resource Access Manager (RAM) is used to share the transit gateway from the centralized networking account with the member accounts, allowing those accounts to create attachments to the shared transit gateway. Option C is incorrect because VPC endpoints are for private connectivity to AWS services or VPC endpoint services, not for routing traffic through a transit gateway. Option D is incorrect because VPC peering creates direct VPC-to-VPC connectivity that bypasses the transit gateway, which contradicts the requirement that all inter-VPC traffic flow through the transit gateway.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.