ANS-C01 · Question #116
A company has deployed its AWS environment in a single AWS Region. The environment consists of a few hundred application VPCs, a shared services VPC, and a VPN connection to the company's…
The correct answer is C. Configure a separate transit gateway route table for all application VPCs. Associate all application E. Configure a separate transit gateway route table for on premises and the shared services VPC. Explanation Options C and E are correct because they achieve all three requirements using only two route tables - the minimum possible. Option C creates one route table for all application VPCs, where each application VPC attachment is associated but only the shared services…
Question
A company has deployed its AWS environment in a single AWS Region. The environment consists of a few hundred application VPCs, a shared services VPC, and a VPN connection to the company's on-premises environment. A network engineer needs to implement a transit gateway with the following requirements:
- Application VPCs must be isolated from each other.
- Bidirectional communication must be allowed between the application
VPCs and the on-premises network.
- Bidirectional communication must be allowed between the application
VPCs and the shared services VPC. The network engineer creates the transit gateway with options disabled for default route table association and default route table propagation. The network engineer also creates the VPN attachment for the on-premises network and creates the VPC attachments for the application VPCs and the shared services VPC. The network engineer must meet all the requirements for the transit gateway by designing a solution that needs the least number of transit gateway route tables. Which combination of actions should the network engineer perform to accomplish this goal? (Choose two.)
Options
- AConfigure a separate transit gateway route table for on premises. Associate the VPN attachment
- BConfigure a separate transit gateway route table for each application VPC. Associate each
- CConfigure a separate transit gateway route table for all application VPCs. Associate all application
- DConfigure a separate transit gateway route table for the shared services VPC. Associate the
- EConfigure a separate transit gateway route table for on premises and the shared services VPC.
Explanation
Explanation
Options C and E are correct because they achieve all three requirements using only two route tables - the minimum possible. Option C creates one route table for all application VPCs, where each application VPC attachment is associated but only the shared services VPC and on-premises routes are propagated (not other application VPCs), enforcing isolation. Option E creates a single route table for both on-premises and shared services, where all application VPC routes are propagated, enabling bidirectional communication with both destinations.
Why the distractors are wrong:
- Option A unnecessarily separates on-premises into its own route table, requiring three total tables instead of two.
- Option B creates a separate route table per application VPC, resulting in hundreds of route tables - the opposite of "least number."
- Option D separates shared services into its own route table (again requiring three tables), when it can be combined with on-premises in a single table as in Option E.
Memory Tip
Think "Two buckets": one bucket for senders (all application VPCs share one route table) and one bucket for receivers (shared services + on-premises share one route table). Application VPCs can reach the "receiver bucket" but can't see each other, achieving isolation with just two route tables.