Which statement about Amazon Web Services (AWS) Transit Gateway is true for SD-WAN transit gateway (TGW) Connect with FortiGate?

Question

Options

• AThe TGW plugin must be used with a VPN to achieve higher bandwidth.
• BTGW supports BGP to share routes with FortiGate.
• CAttaching a virtual private cloud (VPC) to the TGW automatically adds new routes to the subnet
• DThe Generic Routing Encapsulation (GRE)-based tunnel attachments are slower than IPsec

• A
  6% (2)
• B
  9% (3)
• C
  82% (27)
• D
  3% (1)

Explanation

Option C is correct because when you attach a VPC to an AWS Transit Gateway, the TGW automatically propagates routes into the TGW route table, making those VPC CIDR ranges reachable without manual route entry - this is a core behavioral feature of TGW designed to simplify routing at scale.

Why the distractors are wrong:

• A is false - TGW Connect is specifically designed to avoid IPsec VPN overhead; it uses GRE tunnels over a direct attachment, achieving higher bandwidth (up to 20 Gbps per connect attachment) without needing a VPN plugin.
• B is false - While BGP is used with TGW Connect (FortiGate peers via BGP over the GRE tunnel), saying TGW "supports BGP to share routes with FortiGate" is misleadingly incomplete and conflates the protocol with the attachment type; it's not a distinguishing true statement about TGW Connect behavior.
• D is false - GRE-based TGW Connect attachments are actually faster than IPsec; GRE has less overhead since it skips encryption processing, which is the whole point of TGW Connect for SD-WAN use cases.

Memory tip: Think of TGW as an "auto-propagating hub" - the moment you plug a VPC in (attach it), routes flow automatically into the TGW route table, just like plugging into a managed switch that updates its MAC table. For TGW Connect, remember GRE = Greater speed over IPsec.

No community discussion yet for this question.