SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?
⚠ Common exam trap
Watch out — candidates often assume VPC peering can be used for transitive routing or that a NAT gateway provides inspection capabilities, but VPC peering is non-transitive and NAT gateways only perform address translation, not deep packet inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.
A transit gateway allows you to centralize outbound internet traffic by attaching both the production VPC and the inspection VPC, then configuring the production VPC's route table to send 0.0.0.0/0 traffic to the transit gateway. The inspection VPC can then route that traffic through its firewall (e.g., a third-party appliance or AWS Network Firewall) before it reaches an internet gateway, enabling full traffic inspection while maintaining a single egress point.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Cloud WAN to connect the VPCs and route all outbound traffic through the inspection VPC.
Why it's wrong here
AWS Cloud WAN creates a global transit network between VPCs and on-premises sites, but it does not natively enforce centralised egress inspection; traffic can bypass the inspection VPC unless custom route tables and attachments are meticulously configured to force all internet-bound traffic through a single egress point. It is tempting because Cloud WAN simplifies multi-VPC connectivity and is ideal for large-scale inter-region routing, where the goal is connectivity rather than mandatory security inspection.
- ✗
Create a VPC peering connection between the production VPC and the inspection VPC, and route all outbound traffic through the peered connection.
Why it's wrong here
VPC peering is non-transitive, so traffic entering the inspection VPC cannot be routed onward to the internet through it; the production VPC also keeps its own NAT gateway path. Peering suits direct private connectivity between two VPCs, not centralised egress inspection.
- ✓
Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.
Why this is correct
A transit gateway provides transitive routing between the production and inspection VPCs, letting the production route table forward 0.0.0.0/0 to the inspection VPC's firewall before egress. This satisfies the requirement that all internet-bound traffic be inspected centrally.
- ✗
Place a NAT gateway in the inspection VPC and have the production VPC route internet traffic to the NAT gateway.
Why it's wrong here
A NAT gateway cannot be a routing target across VPCs — route tables reference it only within its own VPC, so the production subnet cannot send traffic to a NAT gateway in the inspection VPC. NAT gateways provide egress for subnets inside a single VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.