SAP-C02 Practice Test 3

A retailer runs 25 AWS accounts in one organization in AWS Organizations, one per product team. Each team built its own VPC, and the RFC 1918 range that the enterprise network group allocated to AWS is almost exhausted; every VPC burns a /20 even when the team only runs a handful of instances. The teams' applications are chatty with one another and the current mesh of VPC peering connections has become unmanageable.

The platform group wants a design where a small central network account owns the CIDR, the route tables, the NAT gateways, and the Transit Gateway attachment, and product teams cannot change any of them. Product teams must still launch and manage their own EC2 instances, RDS databases, and Lambda functions in their own accounts, so that each team keeps its own bill, its own IAM boundaries, and its own CloudFormation stacks. Traffic between two teams' instances must stay inside a single VPC rather than crossing a peering or Transit Gateway hop.

Which design meets these requirements?