Which AWS Service Connects VPCs and On-Premises Networks to a Central Hub?
Which AWS service or feature gives users the ability to connect VPCs and on-premises networks to a central hub?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests recognition of AWS' hub-and-spoke interconnection service; the trap is confusing the Transit Gateway with the Virtual Private Gateway, which only anchors one VPC to one VPN or Direct Connect link.
AWS Transit Gateway is the network service that acts as a central hub, letting you connect many VPCs, VPNs, and on-premises networks through a single transitive router. This page confirms why option B is correct on CLF-C02 and why virtual private gateway, internet gateway, and customer gateway do not provide hub-and-spoke connectivity.
Many learners pick Virtual private gateway (A) because it also touches VPN connectivity, but it attaches a single VPC to a single on-premises connection and cannot hub multiple VPCs together transitively.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Transit Gateway is explicitly described by AWS as a network transit hub that interconnects VPCs and on-premises networks through a central gateway, which is exactly the wording used in the question. It supports transitive routing, so a spoke VPC, a Site-to-Site VPN attachment, and a Direct Connect gateway can all reach one another without full-mesh peerings. One learner summarized it plainly: the Transit Gateway is "Acting as a virtual router" that removes the need for numerous point-to-point connections or Transit VPCs. Nikmah added the keyword the exam reuses, noting it exists for transitive peering across thousands of VPCs and on-premises links in a hub-and-spoke topology. That single transit hub behavior is the discriminating feature.Why the Other Options Are Wrong
A Virtual private gateway (A) is the VPN concentrator attached on the VPC side of a single Site-to-Site VPN or Direct Connect connection — it terminates one link, not a mesh of many. An Internet gateway (C) provides public internet reachability for a VPC and has nothing to do with interconnecting networks privately. A Customer gateway (D) is the AWS-side resource that represents the physical customer device on the far end of a VPN; it is a definition of a peer, not a hub. None of these three offer transitive, many-to-many connectivity.Community Comment Notes
Community sentiment is unanimous, with 100% of votes landing on B and reddy187 stating simply that "Answer is B". The most detailed comment attributes the choice to the Transit Gateway's role as a virtual router that simplifies architecture by eliminating many point-to-point connections. Because the explanation matches AWS' own definition of a transit hub, there is no conflict between the community consensus and the source answer key here.Exam Strategy
When a CLF-C02 question mentions a "central hub" or "transitive" connectivity between VPCs and on-premises networks, map that directly to AWS Transit Gateway before reading the distractors. Remember the pairing rule: Virtual private gateway = one VPC's VPN endpoint, Customer gateway = your on-premises device, Transit Gateway = the hub that connects everything.Official Reference
Exam Strategy
Scan for keywords like "central hub," "transitive," or "thousands of VPCs" — these are AWS Transit Gateway triggers on CLF-C02. Immediately eliminate gateway options tied to a single connection (virtual private gateway, customer gateway) or to public internet access (internet gateway).
Frequently Asked Questions
Why is a virtual private gateway wrong if it also connects to on-premises networks?
A virtual private gateway terminates one Site-to-Site VPN or Direct Connect link for a single VPC. It cannot interconnect many VPCs transitively, so it is not a central hub.
What makes the customer gateway different from AWS Transit Gateway?
A customer gateway is an AWS resource that represents the physical VPN device in your on-premises network. It defines a peer endpoint, while Transit Gateway routes traffic between many networks.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →