SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?
⚠ Common exam trap
Many candidates confuse IAM permissions (Option D) with resource-based sharing via RAM, thinking that granting IAM roles to create attachments is sufficient, but RAM provides explicit authorization at the resource level, which is more secure and scalable for cross-account access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.
AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a VPN connection from each application VPC to the shared VPC.
Why it's wrong here
A VPN connection from each application VPC to the shared VPC introduces per-tunnel management overhead and does not natively enforce authorisation at the AWS Transit Gateway attachment level; the networking team would need to manually approve or reject each VPN tunnel, which does not scale across many accounts. This option is tempting because VPNs are a standard method for securely bridging separate networks, and in a scenario where the shared VPC is in a different AWS Region or an on-premises environment without Transit Gateway, a VPN would be the correct choice.
- ✓
Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.
Why this is correct
RAM allows sharing the Transit Gateway, and the networking team can accept or reject attachments via RAM.
- ✗
Use VPC peering between the shared VPC and each application VPC.
Why it's wrong here
VPC peering is not transitive and does not scale to many VPCs.
- ✗
Create IAM roles in each application account that allow the networking team to create VPC attachments.
Why it's wrong here
This would give the networking team excessive privileges and is not scalable.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.