Get Your CertSAP-C02PlayCompete
‹ All SAP-C02 questions

SAP-C02 Practice Question 3: Multi Region Transit Gateway Direct Connect

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 1 · question 3 of 10

Hybrid Networkinghard

A media company operates 60 VPCs spread across 12 AWS accounts in two Regions, us-east-1 and eu-west-1. On-premises data centres terminate two 10 Gbps AWS Direct Connect connections at two different Direct Connect locations for resilience.

The network team must deliver a design in which every VPC in both Regions can reach the on-premises networks over Direct Connect; VPCs within the same Region can reach each other; VPC-to-VPC traffic between the two Regions traverses only the AWS global backbone and never the public internet or the customer's own WAN; the number of connections that must be built and maintained grows roughly linearly rather than quadratically as VPCs are added; and routing is administered centrally from a shared networking account while workload accounts attach their own VPCs themselves.

Which design meets all of these requirements?

Select one answer
Show answer and explanation

Answer:

  • D. Deploy a transit gateway in each Region in the networking account, share both with the member accounts using AWS Resource Access Manager, create a transit gateway peering attachment between the two Regions, and associate both transit gateways with a Direct Connect gateway that has transit virtual interfaces on the two connections

A transit gateway is a Regional resource: VPC attachments must be in the same Region as the transit gateway. So a two-Region footprint needs two transit gateways, joined by an inter-Region transit gateway peering attachment, which carries traffic over the AWS global backbone with encryption and never touches the internet. Sharing each transit gateway with AWS RAM lets each workload account create its own VPC attachment while route tables stay under the networking account's control, the central-administration requirement. For hybrid reachability, a single Direct Connect gateway can be associated with transit gateways in different Regions (AWS only requires that each transit gateway use a unique BGP ASN), and transit virtual interfaces on both 10 Gbps connections give the resilient on-premises path. Attachment count grows one-per-VPC instead of one-per-VPC-pair.

Option A is the quadratic design the stem explicitly rejects: full-mesh peering across 60 VPCs is roughly 1,770 peering connections, peering is non-transitive so it cannot provide the hybrid path, and one private virtual interface per VPC quickly exhausts Direct Connect virtual interface quotas.

Option B is not buildable. VPCs cannot attach to a transit gateway in another Region, so the eu-west-1 VPCs have no attachment path, and there is no cross-Region VPC attachment feature.

Option C fails two constraints. A Site-to-Site VPN between the transit gateways runs over the public internet rather than the AWS backbone, and it caps a single tunnel around 1.25 Gbps. Falling back to per-VPC private virtual interfaces on virtual private gateways also reintroduces the per-VPC connection sprawl and decentralizes routing.

Reference: Direct Connect gateways and Transit Gateway associations

Practice Test 1 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.
AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.
IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.
VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.