SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has a single AWS account with multiple VPCs. They want to connect all VPCs to a central VPC for shared services, such as Active Directory and DNS, without using a complex mesh of VPC peering connections. They also want to minimize costs. Which solution should they use?
⚠ Common exam trap
The trap here is assuming that VPC peering is always the cheapest option, but for multiple VPCs, Transit Gateway can be more cost-effective and manageable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Transit Gateway to connect all VPCs and the shared services VPC.
AWS Transit Gateway provides a central hub to connect multiple VPCs and shared services. It simplifies network architecture, reduces management overhead, and is cost-effective compared to a full mesh of VPC peering connections. It allows all VPCs to access the shared services VPC without complex peering arrangements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS PrivateLink to connect each VPC to the shared services VPC.
Why it's wrong here
AWS PrivateLink provides private connectivity to services, but it is not designed to connect entire VPCs. It is used for one-way access to specific services via endpoints. It does not provide full VPC-to-VPC connectivity or transitive routing, so it cannot connect all VPCs to a central VPC for shared services like Active Directory and DNS in the required manner.
- ✗
Create a full mesh of VPC peering connections between all VPCs.
Why it's wrong here
A full mesh of VPC peering connections is complex to manage and does not scale well. It also does not provide a central point for shared services; each VPC would need to peer with every other VPC. This increases management overhead and cost, and does not meet the requirement to minimize costs and complexity.
- ✓
Use AWS Transit Gateway to connect all VPCs and the shared services VPC.
Why this is correct
AWS Transit Gateway acts as a central hub to connect multiple VPCs and on-premises networks. It simplifies network architecture by eliminating complex peering meshes. With Transit Gateway, you can connect all VPCs to a single gateway, and the shared services VPC can be accessed by all. This is scalable and cost-effective compared to multiple peering connections.
- ✗
Create a VPN connection between each VPC and the shared services VPC.
Why it's wrong here
VPN connections are typically used for connecting on-premises networks to AWS, not for VPC-to-VPC connectivity within AWS. Using VPNs between VPCs would require VPN gateways and customer gateways, which add complexity and cost. It is not a recommended or cost-effective solution for connecting multiple VPCs within a single account.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.