hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A cloud architect is designing a hybrid network…
A cloud architect is designing a hybrid network between on-premises and AWS. They need to ensure traffic to the internet from the VPC uses the on-premises security stack for inspection. The VPC has an Internet Gateway (IGW). What must be configured to force outbound traffic to the on-premises firewall?
⚠ Common exam trap
Cisco often tests the misconception that a NAT Gateway or VPC Endpoints can redirect traffic to on-premises, but the correct mechanism is a route table entry pointing to the virtual private gateway or transit gateway attachment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the VPC route table to point 0.0.0.0/0 to the virtual private gateway or transit gateway attachment
To force all outbound internet traffic from the VPC through the on-premises firewall, the VPC route table must have a default route (0.0.0.0/0) pointing to the virtual private gateway (VPG) or transit gateway (TGW) attachment. This directs traffic over the VPN or Direct Connect to the on-premises network, where the security stack inspects it before reaching the internet. The Internet Gateway (IGW) remains present but is not used for this traffic because the route table entry overrides it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use VPC Endpoints for all services
Why it's wrong here
VPC Endpoints are for private connectivity to AWS services, not internet routing.
- ✗
Deploy a NAT Gateway and assign it to the route table
Why it's wrong here
NAT Gateway provides internet access for private subnets, but doesn't force traffic on-prem.
- ✓
Update the VPC route table to point 0.0.0.0/0 to the virtual private gateway or transit gateway attachment
Why this is correct
This routes internet traffic through the VPN to on-premises.
- ✗
Configure security groups to block direct internet access
Why it's wrong here
Security groups control access, not routing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.