SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?
⚠ Common exam trap
Many candidates assume Transit Gateway can handle overlapping CIDRs natively, but it cannot; the NAT gateway is required to perform address translation before traffic enters the Transit Gateway, and this is the most scalable solution without renumbering VPCs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.
It uses a NAT gateway in each VPC to translate overlapping private IPs to unique private IPs from a separate CIDR block before routing through the Transit Gateway. This allows the Transit Gateway to forward traffic without conflict, as the NAT gateway performs source network address translation (SNAT) to eliminate IP overlap. This approach is highly scalable because it avoids re-architecting existing VPCs and can be applied incrementally as new VPCs are added.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS PrivateLink to connect each VPC to the network account.
Why it's wrong here
PrivateLink does not solve general IP overlap for all traffic.
- ✗
Create VPC peering connections between each VPC and the network account.
Why it's wrong here
Peering also requires non-overlapping CIDRs for communication.
- ✓
Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.
Why this is correct
NAT translates overlapping IPs to unique addresses, enabling communication.
- ✗
Assign new non-overlapping CIDR ranges to each VPC and update all resources.
Why it's wrong here
Re-IPing is disruptive and not scalable for many accounts.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.