nerdexam
Amazon

SAP-C02 · Question #605

A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The…

The correct answer is A. Create a transit gateway in an AWS account. Share the transit gateway across accounts by using C. Setup transit gateway route tables. Associate the VPCs and VPNs with the route tables. E. Configure attachments between the VPCs and VPNs. To connect hundreds of AWS VPCs to an on-premises network with granular inter-VPC communication control and minimal operational effort, implement an AWS Transit Gateway, share it via AWS RAM, create attachments for all VPCs and VPNs, and configure Transit Gateway route tables.

Submitted by haruto_sh· Mar 6, 2026Design Solutions for Organizational Complexity

Question

A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The company wants to connect its AWS accounts to its on-premises network. AWS Site-to-Site VPN connections are already established to a single AWS account. The company wants to control which VPCs can communicate with other VPCs. Which combination of steps will achieve this level of control with the LEAST operational effort? (Choose three.)

Options

  • ACreate a transit gateway in an AWS account. Share the transit gateway across accounts by using
  • BConfigure attachments to all VPCs and VPNs.
  • CSetup transit gateway route tables. Associate the VPCs and VPNs with the route tables.
  • DConfigure VPC peering between the VPCs.
  • EConfigure attachments between the VPCs and VPNs.
  • FSetup route tables on the VPCs and VPNs.

How the community answered

(26 responses)
  • A
    62% (16)
  • B
    23% (6)
  • D
    12% (3)
  • F
    4% (1)

Why each option

To connect hundreds of AWS VPCs to an on-premises network with granular inter-VPC communication control and minimal operational effort, implement an AWS Transit Gateway, share it via AWS RAM, create attachments for all VPCs and VPNs, and configure Transit Gateway route tables.

ACreate a transit gateway in an AWS account. Share the transit gateway across accounts by usingCorrect

Creating and sharing a Transit Gateway across accounts using AWS Resource Access Manager (AWS RAM) provides a scalable and central hub for connecting hundreds of VPCs to on-premises networks efficiently.

BConfigure attachments to all VPCs and VPNs.

This option is a partial duplicate of option E and does not encompass the full solution for controlling communication and managing operational effort.

CSetup transit gateway route tables. Associate the VPCs and VPNs with the route tables.Correct

Transit Gateway route tables allow for fine-grained control over which VPCs and VPNs can communicate with each other through explicit route table associations and propagations, minimizing operational overhead compared to managing individual VPC peering routes.

DConfigure VPC peering between the VPCs.

VPC peering connects two VPCs directly and does not scale well for hundreds of VPCs, making it high operational effort to manage routing and connectivity across a large number of connections.

EConfigure attachments between the VPCs and VPNs.Correct

Configuring attachments for all VPCs and VPNs to the Transit Gateway is essential for establishing the connectivity paths required for both inter-VPC and hybrid cloud communication.

FSetup route tables on the VPCs and VPNs.

Setting up route tables on each VPC and VPN directly would require immense operational effort for hundreds of VPCs, as individual route table management for inter-VPC communication is not scalable.

Concept tested: AWS Transit Gateway, cross-account networking, routing control

Source: https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html

Community Discussion

No community discussion yet for this question.

Full SAP-C02 Practice