SAP-C02 Practice Question 93: Cloud WAN Segments Policy

AWS Certified Solutions Architect – Professional (SAP-C02) · Test 10 · question 3 of 10

Hybrid Networkinghard

A company runs about 200 VPCs across four AWS Regions, plus on-premises sites connected by VPN. It wants three isolated routing domains (production, development and shared services), with shared services reachable from both production and development but production and development unable to reach each other. New VPCs should be placed in the right domain automatically based on a tag, and the configuration must be consistent in all Regions without the network team synchronizing route tables Region by Region.

Which solution meets these requirements with the LEAST operational effort?

Show answer and explanation

Answer:

A. Create an AWS Cloud WAN core network whose policy defines the three segments, shares routes from the shared-services segment, and maps VPCs to segments by tag

With AWS Cloud WAN, a *core network policy* is *"a single document applied to your core network that captures your intent and deploys it for you"* and defines *"segments, AWS Region routing, and how attachments should map to segments."* *Segments* are *"dedicated routing domains, which means that by default, only attachments within the same segment can communicate,"* and *segment actions* define how routes are shared between segments, for example sharing a shared-services segment. With attachment policies, *"attachments are tagged"* and those tags are associated with the applicable segment, and *"AWS maintains a consistent configuration across AWS Regions for you, instead of you needing to synchronize configuration across every device in your network"* (option A).

- B is wrong because it can reach a similar result, but the team would maintain route tables and static routes in each Region by hand, which is the effort the company wants to avoid. - C is wrong because a peering mesh for 200 VPCs is unmanageable, is not transitive, and gives no central routing-domain policy or on-premises connectivity. - D is wrong because a transit VPC with third-party appliances adds instances to license, scale and patch, and creates a throughput bottleneck.

Reference: What is AWS Cloud WAN?

Practice Test 10 ›

Study guides for SAP-C02

Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.

SAP-C02 vs SAP-C03, the Solutions Architect Professional updateWhat changes when AWS replaces SAP-C02 with SAP-C03, the key dates, who should still sit SAP-C02, and how to study through the switch without wasted work.

AWS disaster recovery strategies, RTO and RPOBackup and restore, pilot light, warm standby and active/active on AWS, how RTO and RPO pick between them, and the services each strategy uses.

IAM users, roles and policies on AWSHow IAM users, roles, identity-based and resource-based policies, cross-account access, SCPs and permissions boundaries fit together for AWS exams.

SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.

VPC endpoints vs NAT gateways on AWSWhen to use gateway endpoints, interface endpoints (PrivateLink) or a NAT gateway for private subnets, and the cost and security trade-offs exams test.