The correct architecture is to deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC. This works because Transit Gateway acts as a regional hub, allowing you to interconnect multiple VPCs across different accounts while using route tables to steer inter-VPC traffic through a dedicated inspection VPC for centralized network inspection. On the SAP-C02 exam, this scenario tests your understanding of transitive routing and centralized security models—a common trap is assuming VPC peering or a simple VPN hub suffices, but those lack the granular route control and scalability of Transit Gateway. Remember the key principle: Transit Gateway route tables enable you to isolate and force traffic paths, so the inspection VPC becomes a mandatory hop for all east-west traffic. A useful memory tip is “Hub and Inspect”—the Transit Gateway is the hub, and the inspection VPC is the mandatory checkpoint for all traffic flows.
SAP-C02 Practice Question: Design Solutions for Organizational Complexity
This SAP-C02 practice question tests your understanding of design solutions for organizational complexity. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?
Create VPC peering connections between all VPCs and use security groups for inspection
Why wrong: VPC peering is not transitive and does not support central inspection.
B
Configure a VPN between each VPC and a central virtual appliance
Why wrong: Not scalable and adds complexity.
C
Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC
Transit Gateway provides transitive routing and central inspection.
D
Use AWS Direct Connect to connect all VPCs to a common router
Why wrong: Direct Connect is for on-premises, not inter-VPC.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC
Option C is correct because AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Create VPC peering connections between all VPCs and use security groups for inspection
Why it's wrong here
VPC peering is not transitive and does not support central inspection.
✗
Configure a VPN between each VPC and a central virtual appliance
Why it's wrong here
Not scalable and adds complexity.
✓
Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC
Why this is correct
Transit Gateway provides transitive routing and central inspection.
Related concept
Read the scenario before looking for a memorised answer.
✗
Use AWS Direct Connect to connect all VPCs to a common router
Why it's wrong here
Direct Connect is for on-premises, not inter-VPC.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse VPC peering (which is simple but unscalable and lacks central inspection) with Transit Gateway, or they incorrectly assume that Direct Connect or VPNs are designed for inter-VPC connectivity rather than hybrid connectivity to on-premises.
Detailed technical explanation
How to think about this question
AWS Transit Gateway uses a hub-and-spoke model where each VPC attachment is associated with a route table; you can create separate route tables for spokes and the inspection VPC, and use blackhole routes or static routes to force traffic through the inspection VPC's ENIs. For example, you can configure the inspection VPC to have a Gateway Load Balancer (GWLB) that distributes traffic to third-party security appliances, and the Transit Gateway route tables can point to the GWLB endpoint for all inter-VPC traffic. This architecture supports up to thousands of VPCs and can be extended across accounts using AWS Resource Access Manager (RAM) for shared Transit Gateway attachments.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design Solutions for Organizational Complexity — This question tests Design Solutions for Organizational Complexity — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC — Option C is correct because AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.
What should I do if I get this SAP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.