How to Isolate Business Units Across Multiple Regions with AWS Cloud WAN?

ANS-C01 By islever Editorial Last updated

Short answer

B Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Use segment actions to control traffic between segments.

Question

A company has two business units (BUs). The company operates in the us-east-1 Region and the us-west-1 Region. The company plans to extend to more Regions in the future. Each BU has a VPC in each Region. Each Region has a transit gateway with the BU VPCs attached. The transit gateways in both Regions are peered. The company will create several more BUs in the future and will need to isolate some of the BUs from the other BUs. The company wants to migrate to an architecture to incorporate more Regions and BUs. Which solution will meet these requirements with the MOST operational efficiency?
  1. Create a new transit gateway for each new BU in each Region. Peer the new transit gateways with the existing transit gateways. Update the route tables to control traffic between BUs.
  2. Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Use segment actions to control traffic between segments. Correct Answer
  3. Create an AWS Cloud WAN core network with an edge location in both Regions. Configure a segment for each BU with VPC attachments to the new BU VPCs. Configure the segments to isolate attachments to control traffic between segments.
  4. Attach new VPCs to the existing transit gateways. Update route tables to control traffic between BUs.

Key Takeaways

This question tests the difference between Transit Gateway route tables and AWS Cloud WAN segments with segment actions for global multi-BU isolation, emphasizing operational efficiency at scale.

AWS Cloud WAN uses segments and segment actions to isolate business units across multiple regions with high operational efficiency, replacing complex Transit Gateway peering meshes. Community consensus strongly favors Cloud WAN segments with segment actions for scalable, centrally managed global networking.

Common mistake: Many candidates choose option C, confusing 'isolate attachments' with 'segment actions.' In AWS Cloud WAN, segment actions (not attachment isolation flags) are the explicit mechanism to control inter-segment traffic.

Expert Analysis

The scenario describes a global enterprise expanding across many AWS Regions and Business Units (BUs), requiring selective isolation between BUs. The existing architecture uses Transit Gateways (TGWs) peered across Regions, with each BU having a VPC per Region. While TGW route tables can isolate traffic, managing a growing mesh of peered TGWs and per-BU route tables becomes operationally complex.

AWS Cloud WAN is Amazon's managed global networking service built on a core network with edge locations in each Region. It introduces the concept of segments, which act as logical groupings of VPC attachments. Each BU can be assigned its own segment, and segment actions explicitly define how traffic flows (or is blocked) between segments. This provides a centralized, policy-driven model that scales far better than manually updating TGW route tables across many Regions.

  • Option A (new TGWs per BU, peered) dramatically increases operational overhead: each new BU requires new TGWs in every Region and new peering attachments. This does not meet the "MOST operational efficiency" requirement.
  • Option C mentions "configure the segments to isolate attachments," which is misleading. In Cloud WAN, isolation between segments is controlled via segment actions (e.g., SendAttachmentData to specific segments or denying traffic). There is no simple "isolate attachments" toggle that replaces segment actions.
  • Option D (attach to existing TGWs, update route tables) works today but does not scale efficiently as more Regions and BUs are added. Route table management becomes error-prone and complex.
Option B is correct: Cloud WAN with one segment per BU and segment actions to control inter-segment traffic delivers the required isolation with centralized management and minimal operational overhead as the company grows.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question emphasizes 'MOST operational efficiency' for global multi-tenant isolation, prefer AWS Cloud WAN segments with segment actions over Transit Gateway route table management. Watch for distractor wording like 'isolate attachments'—the correct AWS terminology is 'segment actions.'

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. AzureDP900 👍 1 Answered B
    Option B: This solution involves creating an AWS Cloud WAN core network with an edge location in both Regions, configuring a segment for each BU with VPC attachments to the new BU VPCs. Segment-based routing : Segment actions can control traffic between segments and provide a more isolated environment, which is necessary when dealing with multiple BUs. This makes it easier to isolate certain BUs from others while maintaining connectivity between others. Option B also provides flexibility and scalability as new Regions can be added, and new segments can be created without requiring additional changes to existing transit gateways or VPCs.
  2. woorkim 👍 1 Answered B
    Option A requires creating and peering multiple transit gateways, which increases complexity. Option C is similar to B but lacks the explicit segment action specification. Option D lacks the scalability and isolation capabilities needed for future expansion.
  3. secdaddy 👍 1 Answered C
    Stated goal is to isolate some BUs from other BUs with the most operational efficiency so I am going with isolate attachements.
  4. 973b658 👍 6 Answered B
    it is B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide