SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?
⚠ Common exam trap
Many exam-takers choose VPC peering (Option C) because it is familiar, but they overlook the requirement to avoid route table manipulation and the lack of transitive routing, which makes peering unsuitable for centralized inspection across multiple accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.
AWS Transit Gateway (TGW) allows you to centralize network traffic through a security appliance VPC. By attaching all VPCs to a single TGW and configuring route tables to route inter-VPC traffic to the firewall appliance in the security VPC, you meet the inspection requirement without manual route table manipulation in each spoke VPC. This design minimizes complexity by using a hub-and-spoke topology with centralized routing control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.
Why it's wrong here
PrivateLink is for services, not for routing all traffic.
- ✗
Set up AWS Direct Connect gateway and route all traffic through the security account.
Why it's wrong here
Direct Connect Gateway is designed for connecting on-premises networks to multiple VPCs across accounts, not for routing inter-VPC traffic within AWS for centralised inspection. It lacks the native capability to force traffic between VPCs through a specific security VPC without extensive, complex route table manipulation. This option is tempting because it offers cross-account connectivity and a centralised point, which is suitable for hybrid cloud scenarios where on-premises resources need to access multiple AWS VPCs.
- ✗
Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.
Why it's wrong here
Complex and scalable poorly.
- ✓
Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.
Why this is correct
Correct: Centrally managed and scales well.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.