SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?
⚠ Common exam trap
Watch out — candidates often assume VPC peering (Option C) can be used for transitive routing, but VPC peering does not support transitive routing, making it impossible to route traffic through an inspection VPC to other VPCs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.
It uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS PrivateLink to route traffic through the NGFW.
Why it's wrong here
PrivateLink is for accessing services, not for traffic inspection.
- ✓
Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.
Why this is correct
This forces all inter-VPC traffic to go through the inspection VPC.
- ✗
Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.
Why it's wrong here
VPC peering does not support transitive routing; each pair needs a separate peering.
- ✗
Set up AWS Direct Connect between all VPCs and the inspection VPC.
Why it's wrong here
Direct Connect is for on-premises, not for VPC-to-VPC routing.
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?
hard- ✓ A.Attach the VPCs in member accounts to the transit gateway.
- ✓ B.Update the route tables of the VPCs to point to the transit gateway for inter-VPC traffic.
- C.Create VPC endpoints for the transit gateway in each VPC.
- D.Create VPC peering connections between each VPC and the networking VPC.
- ✓ E.Share the transit gateway with the member accounts using AWS Resource Access Manager.
Why A: Attaching the VPCs in member accounts to the transit gateway is a fundamental step to establish connectivity. The transit gateway acts as a central hub, and each VPC must be explicitly attached to it to route traffic through the gateway. Without attachment, the transit gateway cannot forward traffic to or from those VPCs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.