A company is migrating a new application from an on-premises data center to a new VPC in the AWS Cloud. The company has multiple AWS accounts and VPCs that share many subnets and applications. The…

Question

Options

• AVPC peering:Creates a fully meshed architecture, which is complex to manage for multiple
• BTransit gateway:Simplifies network management by connecting multiple VPCs and on-
• CPrivateLink:Restricts communication to the application endpoint but may not allow full VPC
• DALB with internet exposure:Not secure or specific to private network communication.

• A
  2% (1)
• B
  73% (30)
• C
  17% (7)
• D
  7% (3)

Explanation

Transit Gateway (B) is correct because it acts as a central hub that connects multiple VPCs and on-premises networks through a single gateway, enabling fine-grained route table controls that allow you to specify exactly which resources across accounts and VPCs can reach the new application - without requiring a complex mesh of individual connections.

VPC Peering (A) fails at scale because it requires a separate peering connection between every pair of VPCs (no transitive routing), resulting in an unmanageable full-mesh topology as the number of VPCs grows. PrivateLink (C) is excellent for exposing a single service endpoint but only enables one-directional service access - it doesn't provide the broad, routable network connectivity needed for resources spread across many VPCs and accounts to all reach the application. ALB with internet exposure (D) is eliminated immediately since the requirement is for private network communication, and exposing an internal application to the internet is both insecure and architecturally wrong for this scenario.

Memory tip: Think of Transit Gateway as a "network router in the cloud" - just as a physical router connects many network segments through one device with routing policies, Transit Gateway connects many VPCs/accounts through one hub with route tables. If the question mentions multiple VPCs + accounts + fine-grained access control, Transit Gateway is almost always the answer over VPC Peering.

No community discussion yet for this question.