The answer is to create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW. This works because the blackhole route acts as a sink for any direct traffic between VPCs, preventing it from being routed directly; instead, you propagate a more specific route from the inspection VPC that points all inter-VPC traffic toward the NGFW appliance, forcing every packet through centralized inspection. On the SAP-C02 exam, this scenario tests your understanding of transitive routing and centralized security architectures, often appearing as a trap where you might mistakenly choose VPC peering or a simple static route. The key insight is that a transit gateway route table’s blackhole route is the most efficient way to block direct paths and redirect traffic without complex scripting. Memory tip: think “blackhole blocks direct, inspection VPC redirects all” — the blackhole is your enforcement point, not a dead end.
SAP-C02 Practice Question: Design Solutions for Organizational Complexity
This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.
Option B is correct because it uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use AWS PrivateLink to route traffic through the NGFW.
Why it's wrong here
PrivateLink is for accessing services, not for traffic inspection.
✓
Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.
Why this is correct
This forces all inter-VPC traffic to go through the inspection VPC.
Related concept
Read the scenario before looking for a memorised answer.
✗
Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.
Why it's wrong here
VPC peering does not support transitive routing; each pair needs a separate peering.
✗
Set up AWS Direct Connect between all VPCs and the inspection VPC.
Why it's wrong here
Direct Connect is for on-premises, not for VPC-to-VPC routing.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume VPC peering (Option C) can be used for transitive routing, but VPC peering does not support transitive routing, making it impossible to route traffic through an inspection VPC to other VPCs.
Detailed technical explanation
How to think about this question
The transit gateway uses route tables to control traffic flow; by attaching the inspection VPC to a separate route table with a blackhole route for inter-VPC CIDRs, all traffic between VPCs is forced to the inspection VPC's attachment. The NGFW appliance in the inspection VPC performs stateful inspection and then routes the traffic back to the transit gateway, which forwards it to the destination VPC. This design supports centralized inspection without requiring a full mesh of VPC peering or complex routing, and it scales to hundreds of VPCs across multiple accounts using AWS Resource Access Manager.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW. — Option B is correct because it uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.
What should I do if I get this SAP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?
hard
✓ A.Attach the VPCs in member accounts to the transit gateway.
✓ B.Update the route tables of the VPCs to point to the transit gateway for inter-VPC traffic.
C.Create VPC endpoints for the transit gateway in each VPC.
D.Create VPC peering connections between each VPC and the networking VPC.
✓ E.Share the transit gateway with the member accounts using AWS Resource Access Manager.
Why A: Option A is correct because attaching the VPCs in member accounts to the transit gateway is a fundamental step to establish connectivity. The transit gateway acts as a central hub, and each VPC must be explicitly attached to it to route traffic through the gateway. Without attachment, the transit gateway cannot forward traffic to or from those VPCs.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.