hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A multinational corporation is migrating its…
A multinational corporation is migrating its on-premises data center to a public cloud provider. The security policy requires that all traffic between cloud VPCs and the on-premises network must be inspected by a next-generation firewall (NGFW) deployed in the cloud. The on-premises network uses BGP for dynamic routing. Which design meets the requirement while minimizing latency and administrative overhead?
⚠ Common exam trap
Cisco often tests the misconception that a cloud-native service like AWS Transit Gateway inherently supports dynamic routing with NGFW inspection, but the trap is that Transit Gateway uses static routes for traffic steering unless integrated with a transit VPC and BGP, leading candidates to choose Option B incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a transit VPC with an NGFW instance and configure BGP dynamic routing between the transit VPC, other VPCs, and the on-premises network.
A transit VPC with an NGFW instance allows centralized traffic inspection while using BGP dynamic routing to exchange routes between the transit VPC, other VPCs, and the on-premises network. This design minimizes administrative overhead by avoiding static route management and reduces latency by keeping inspection within the cloud, rather than hair-pinning traffic on-premises. BGP enables automatic failover and route propagation, meeting the dynamic routing requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a transit VPC with an NGFW instance and configure BGP dynamic routing between the transit VPC, other VPCs, and the on-premises network.
Why this is correct
Transit VPC with NGFW and BGP allows traffic inspection and dynamic route exchange.
- ✗
Use AWS Transit Gateway with static routes pointing to the NGFW instance for inspection.
Why it's wrong here
Static routing is less flexible and does not support dynamic route exchange with on-premises BGP.
- ✗
Create a site-to-site VPN between each VPC and the on-premises network, and configure the NGFW on-premises.
Why it's wrong here
Traffic would not be inspected in the cloud; on-premises inspection introduces latency for cloud-to-cloud traffic.
- ✗
Use AWS Direct Connect to connect all VPCs to the on-premises network and place the NGFW on-premises.
Why it's wrong here
Direct Connect provides connectivity but does not inspect traffic; on-premises inspection adds latency.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.