SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?
⚠ Common exam trap
Watch out — candidates often assume VPC peering can be used for transitive routing or that a NAT gateway provides inspection capabilities, but VPC peering is non-transitive and NAT gateways only perform address translation, not deep packet inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.
A transit gateway allows you to centralize outbound internet traffic by attaching both the production VPC and the inspection VPC, then configuring the production VPC's route table to send 0.0.0.0/0 traffic to the transit gateway. The inspection VPC can then route that traffic through its firewall (e.g., a third-party appliance or AWS Network Firewall) before it reaches an internet gateway, enabling full traffic inspection while maintaining a single egress point.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Cloud WAN to connect the VPCs and route all outbound traffic through the inspection VPC.
Why it's wrong here
AWS Cloud WAN creates a global transit network between VPCs and on-premises sites, but it does not natively enforce centralised egress inspection; traffic can bypass the inspection VPC unless custom route tables and attachments are meticulously configured to force all internet-bound traffic through a single egress point. It is tempting because Cloud WAN simplifies multi-VPC connectivity and is ideal for large-scale inter-region routing, where the goal is connectivity rather than mandatory security inspection.
- ✗
Create a VPC peering connection between the production VPC and the inspection VPC, and route all outbound traffic through the peered connection.
Why it's wrong here
VPC peering is not transitive and cannot route internet traffic.
- ✓
Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.
Why this is correct
Transit gateway enables transitive routing for inspection.
- ✗
Place a NAT gateway in the inspection VPC and have the production VPC route internet traffic to the NAT gateway.
Why it's wrong here
NAT gateway is not a transit device.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.