Exams / SAP-C03 / Study guide / Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN)
Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN): SAP-C03 study notes and practice questions
What to know about Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN) for the SAP-C03 exam, from the Architecture Design and Implementation Built for the Cloud domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks how to connect many VPCs and on-premises networks with segmentation and the least operational overhead, and how to expose a single service to other accounts without opening up whole networks.
Connectivity options
Option
Fits
Watch for
VPC peering
A few VPCs, highest bandwidth, no extra hop or per-GB processing charge
Not transitive; no overlapping CIDRs; full mesh grows as n(n-1)/2
Transit Gateway
Hub and spoke for many VPCs, VPNs and Direct Connect in a Region; inter-Region peering between TGWs
Per-attachment and per-GB processing charges; route tables per segment
AWS Cloud WAN
Global network across Regions defined by one core network policy, with segments and automatic route propagation
Best when you run many Regions and want central, policy-driven management
AWS PrivateLink
Expose one service (behind an NLB, or a resource through a resource gateway) to consumers in other VPCs or accounts
One-way, consumer-initiated; works with overlapping CIDRs
VPC Lattice
Service-to-service application networking across VPCs and accounts with auth policies
Application-level access to services and resources, not general network routing
Segmentation
Transit Gateway route tables: associate production VPCs with one table and development VPCs with another, and propagate only the routes each should see. Shared services (DNS, inspection, directory) attach to a table both can reach.
Cloud WAN segments do the same globally, with segment actions to share routes or send traffic through inspection.
Put centralized egress (NAT gateways) and centralized inspection in dedicated VPCs attached to the hub; enable appliance mode on the inspection VPC attachment so return traffic stays symmetric.
Sharing across accounts
Share a Transit Gateway, Cloud WAN core network, subnets (shared VPCs), prefix lists and Route 53 Resolver rules through AWS RAM, usually from a central networking account to the organization or OUs.
Shared VPCs let several accounts launch into subnets owned by the network account, cutting the number of VPCs and attachments.
How to choose
Scenario wording
Choose
“Two VPCs, lowest latency and cost”
VPC peering
“Hundreds of VPCs and on-premises sites in one Region”
Transit Gateway
“Global network across many Regions, managed by policy”
Cloud WAN
“Expose one API to customer VPCs with overlapping CIDRs”
PrivateLink endpoint service
“Isolate prod from dev but both reach shared services”
Separate TGW route tables (or Cloud WAN segments)
“App teams shouldn’t manage networking”
Shared VPC subnets through AWS RAM
Common traps
Expecting transitive routing through a peered VPC.
Peering meshes at scale instead of a hub.
Transit Gateway to reach a single service when PrivateLink avoids opening full network paths.
Forgetting appliance mode, so stateful firewalls drop asymmetric flows.
Creating a Transit Gateway in every account instead of sharing one with RAM.
A car maker runs about 60 VPCs across five AWS accounts in six Regions. Production and development workloads must never route to each other, while shared services such as directory and logging must be reachable from both.
Application teams create new VPCs often, and each new VPC must join the right segment automatically, based on a tag, without a ticket to the central network team. The central team wants one place to define the global routing policy.
The network must not depend on routing tables that are edited by hand in each Region.
Which solution meets these requirements?
Choose one answer.
AA. Create a full mesh of VPC peering connections between every pair of VPCs, and use security groups to block development traffic from reaching production.
BB. Build one transit gateway in each Region, peer the gateways with each other, and keep separate production, development and shared services route tables in each Region that the central network team updates by hand.
CC. Create an AWS Cloud WAN core network with production, development and shared services segments, and use tag-based attachment policies to place each new VPC in its segment from one policy document.
DD. Use one Transit Gateway in the primary Region for all six Regions, attach each VPC to it, and create separate route tables for production and development.
Show the answer and explanation
Answer: C
A. Wrong: Peering a full mesh of 60 VPCs grows the connection count quickly and does not route transitively, so shared services need routes added by hand. Security groups do not replace segment-level routing.
B. Wrong: Each Region's route tables would be maintained by hand, which the requirement rules out. Segment separation would also depend on every Region being configured the same way.
C. Right: Correct. Cloud WAN segments keep production and development apart, and shared services can be reached from both segments by policy. Tag-based attachment policies place new VPCs without tickets, and the routing policy lives in one place across Regions.
D. Wrong: A transit gateway is a Regional resource, so VPCs in the other five Regions would need their own gateways. The design does not reach workloads in those Regions with one central policy.
Explanation
Cloud WAN gives segment-based global routing from one policy, with tag-driven attachments for new VPCs. Peering meshes and hand-edited regional gateways fail the manual-effort requirement, and a single Regional transit gateway cannot span the six Regions.
Want more on Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN)? The 5 full-length practice sets have 6 more Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Multi-VPC and multi-account connectivity (Transit Gateway, PrivateLink, Cloud WAN)