SAP-C03 practice question: Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN)
Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A car maker runs about 60 VPCs across five AWS accounts in six Regions. Production and development workloads must never route to each other, while shared services such as directory and logging must be reachable from both.
Application teams create new VPCs often, and each new VPC must join the right segment automatically, based on a tag, without a ticket to the central network team. The central team wants one place to define the global routing policy.
The network must not depend on routing tables that are edited by hand in each Region.
Which solution meets these requirements?
Choose one answer.
AA. Create a full mesh of VPC peering connections between every pair of VPCs, and use security groups to block development traffic from reaching production.
BB. Build one transit gateway in each Region, peer the gateways with each other, and keep separate production, development and shared services route tables in each Region that the central network team updates by hand.
CC. Create an AWS Cloud WAN core network with production, development and shared services segments, and use tag-based attachment policies to place each new VPC in its segment from one policy document.
DD. Use one Transit Gateway in the primary Region for all six Regions, attach each VPC to it, and create separate route tables for production and development.
Show the answer and explanation
Answer: C
A. Wrong: Peering a full mesh of 60 VPCs grows the connection count quickly and does not route transitively, so shared services need routes added by hand. Security groups do not replace segment-level routing.
B. Wrong: Each Region's route tables would be maintained by hand, which the requirement rules out. Segment separation would also depend on every Region being configured the same way.
C. Right: Correct. Cloud WAN segments keep production and development apart, and shared services can be reached from both segments by policy. Tag-based attachment policies place new VPCs without tickets, and the routing policy lives in one place across Regions.
D. Wrong: A transit gateway is a Regional resource, so VPCs in the other five Regions would need their own gateways. The design does not reach workloads in those Regions with one central policy.
Explanation
Cloud WAN gives segment-based global routing from one policy, with tag-driven attachments for new VPCs. Peering meshes and hand-edited regional gateways fail the manual-effort requirement, and a single Regional transit gateway cannot span the six Regions.
Want more on Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN)? The 5 full-length practice sets have 6 more Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →