SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A global company uses AWS Organizations with multiple organizational units (OUs) for different business units. The networking team wants to ensure that all VPCs across all accounts can communicate through a central transit gateway. However, the security team requires that specific accounts cannot access each other's resources. Which combination of actions should the company take to meet these requirements?
⚠ Common exam trap
Test-takers frequently assume a single transit gateway route table with security groups or network ACLs is sufficient, but security groups cannot filter traffic at the VPC level and network ACLs alone do not prevent the transit gateway from routing traffic between VPCs—route table isolation is the primary mechanism to enforce such restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a central transit gateway with separate route tables for each VPC attachment. Use network ACLs in each VPC to restrict traffic between specific VPCs.
It uses a central transit gateway with separate route tables for each VPC attachment, which allows the networking team to enable communication between all VPCs via the transit gateway while the security team can isolate specific accounts by controlling which route tables are associated with which VPC attachments. Network ACLs in each VPC provide an additional layer of stateless traffic filtering to restrict traffic between specific VPCs, complementing the route table isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a central transit gateway with a single route table. Use VPC endpoints to control traffic between VPCs.
Why it's wrong here
VPC endpoints do not control traffic between VPCs through a transit gateway.
- ✗
Create VPC peering connections between all VPCs and use route tables to control access.
Why it's wrong here
VPC peering does not scale well and does not provide central management.
- ✓
Create a central transit gateway with separate route tables for each VPC attachment. Use network ACLs in each VPC to restrict traffic between specific VPCs.
Why this is correct
Separate route tables allow granular routing, and network ACLs can filter traffic at the subnet level.
- ✗
Create a central transit gateway with a single route table. Use security groups in each VPC to restrict traffic.
Why it's wrong here
Security groups cannot filter traffic traversing the transit gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.