SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a multi-account architecture with a shared services account that hosts a central Amazon RDS instance. Member accounts need to access this database. Which TWO actions should the company take to enable secure access?
⚠ Common exam trap
Watch out — candidates often default to VPC peering (Option E) because it is a familiar concept, but they overlook that Transit Gateway (Option A) is the scalable, managed solution for connecting many VPCs in a multi-account environment, as tested in the SAP-C02 exam's organizational complexity domain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Transit Gateway and attach all VPCs to it, then use route tables to enable connectivity.
AWS Transit Gateway acts as a central hub that allows you to connect multiple VPCs (including member account VPCs and the shared services VPC) in a scalable, managed way. By attaching all VPCs to the Transit Gateway and configuring route tables, you enable private, secure connectivity between member accounts and the central RDS instance without requiring individual VPC peering connections or exposing the database to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Transit Gateway and attach all VPCs to it, then use route tables to enable connectivity.
Why this is correct
Centralized connectivity for many VPCs.
- ✗
Use AWS Lambda to proxy database requests from member accounts.
Why it's wrong here
Adds latency and complexity.
- ✓
Configure the RDS security group to allow inbound traffic from the member account VPC CIDRs.
Why this is correct
Allows network access from member VPCs.
- ✗
Make the RDS instance publicly accessible and use IAM authentication.
Why it's wrong here
Security risk; prefer private connectivity.
- ✗
Create a VPC peering connection between each member VPC and the shared services VPC.
Why it's wrong here
VPC peering is not transitive; a Transit Gateway is better for many VPCs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.