SAP-C02 Design for New Solutions Practice Question
A company is designing a multi-account AWS environment using AWS Organizations. The company has several business units that each require their own VPC in shared accounts managed centrally. The company wants to enable VPC sharing to allow business units to create resources in shared subnets while maintaining network isolation. Which combination of steps should the company take to achieve this? (Choose TWO.)
⚠ Common exam trap
The trap here is that candidates might think that VPC peering (option D) or AWS PrivateLink (option E) are required for connectivity, but a transit gateway is more scalable and manageable for connecting multiple VPCs while maintaining network isolation. Additionally, some may mistakenly believe that VPC sharing (via RAM) alone provides connectivity, which it does not; it only allows resource placement in shared subnets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a resource share in AWS Resource Access Manager (RAM) for the shared VPC subnets.
AWS Resource Access Manager (RAM) allows you to share subnets from a centrally owned VPC with other AWS accounts within your AWS Organization. This enables business units to launch resources directly into the shared subnets while the VPC and its networking configuration remain managed centrally. Option B is correct because attaching a transit gateway to the shared VPC and to each business unit's VPC provides the necessary network connectivity between the shared VPC and the business unit VPCs, allowing traffic to flow while maintaining isolation through separate route tables and security group boundaries. Together, these steps enable both resource sharing in the shared subnets and network connectivity with isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a resource share in AWS Resource Access Manager (RAM) for the shared VPC subnets.
Why this is correct
AWS RAM allows sharing subnets with other accounts in the organization.
- ✓
Attach a transit gateway to the shared VPC and to each business unit's VPC.
Why this is correct
A transit gateway enables transitive routing between VPCs while maintaining isolation.
- ✗
Configure VPC endpoints in each business unit VPC to access the shared VPC.
Why it's wrong here
VPC endpoints are for accessing AWS services, not for inter-VPC connectivity.
- ✗
Create VPC peering connections between the shared VPC and each business unit's VPC.
Why it's wrong here
VPC peering does not support transitive routing, making it difficult to scale.
- ✗
Use AWS PrivateLink to connect the business unit VPCs to the shared VPC.
Why it's wrong here
PrivateLink is for accessing services, not for connecting VPCs.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.