AWS Direct Connect with Transit Gateway for Multi-VPC

SAA-C03 By islever Editorial Last updated

Determine high-performing and/or scalable network architectures.

Short answer

A Create a transit gateway, associate Direct Connect with a transit VIF, and enable route propagation.

Question

A company has an AWS Direct Connect connection from its on-premises location to an AWS account. The AWS account has 30 different VPCs in the same AWS Region. The VPCs use private virtual interfaces (VIFs). Each VPC has a CIDR block that does not overlap with other networks under the company's control. The company wants to centrally manage the networking architecture while still allowing each VPC to communicate with all other VPCs and on-premises networks. Which solution will meet these requirements with the LEAST amount of operational overhead?
  1. Create a transit gateway, and associate the Direct Connect connection with a new transit VIF. Turn on the transit gateway's route propagation feature. Correct Answer
  2. Create a Direct Connect gateway. Recreate the private VIFs to use the new gateway. Associate each VPC by creating new virtual private gateways.
  3. Create a transit VPConnect the Direct Connect connection to the transit VPCreate a peering connection between all other VPCs in the Region. Update the route tables.
  4. Create AWS Site-to-Site VPN connections from on premises to each VPC. Ensure that both VPN tunnels are UP for each connection. Turn on the route propagation feature.

Key Takeaways

The key insight is that a Transit Gateway acts as a central hub, simplifying connectivity compared to complex peering or individual VPN setups.

This question addresses connecting multiple VPCs and on-premises networks using AWS Direct Connect and Transit Gateway to minimize operational overhead.

Common mistake: Many candidates incorrectly choose creating peering connections between all VPCs, which leads to high operational overhead due to the mesh complexity.

Expert Analysis

Why the Answer Is Correct

Creating a Transit Gateway and associating it with a Direct Connect gateway via a transit virtual interface allows for centralized management of routing between all VPCs and on-premises networks. Route propagation enables automatic updates to route tables, significantly reducing manual configuration overhead.

Why the Other Options Are Wrong

Option B involves recreating VIFs and managing individual VGWs, which increases operational complexity. Option C suggests creating a transit VP (likely a typo) and peering connections, which does not scale well and requires extensive route table updates. Option D proposes Site-to-Site VPNs for each VPC, which doubles tunnel management per VPC and lacks the performance and simplicity of Direct Connect.

Community Comment Notes

Community consensus strongly supports Option A, citing the hub-and-spoke model of Transit Gateways. Users noted that while attachments are implied, the core mechanism described in A is the correct architectural pattern. One user referenced official documentation confirming the use of transit virtual interfaces with Direct Connect gateways.

Official Reference

https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Focus on solutions that centralize networking components like Transit Gateways to reduce the number of manual configurations required across multiple resources.

Frequently Asked Questions

Why is a Direct Connect gateway used instead of just attaching VPCs directly?

A Direct Connect gateway allows you to connect your Direct Connect connection to multiple Transit Gateways across different Regions or accounts, providing greater flexibility and scalability.

Does enabling route propagation remove the need for manual route updates?

Yes, route propagation automatically adds routes from the Transit Gateway to the attached VPCs' route tables, eliminating manual maintenance for new subnets or changes.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Typewriter101 👍 6 Answered A
    transit gateway -> hub and spoke
  2. MatAlves 👍 3 Answered A
    "You can use AWS Direct Connect gateway to connect your Direct Connect connection over a transit virtual interface to the VPCs or VPNs that are attached to your transit gateway. You associate a Direct Connect gateway with the transit gateway. Then, create a transit virtual interface for your AWS Direct Connect connection to the Direct Connect gateway." https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-transit-gateways.html
  3. cedser8 👍 2
    https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html
  4. alawada 👍 2 Answered A
    Turn on the transit gateway's route propagation feature.
  5. Besisco 👍 1 Answered A
    A, but... why there is not mentioned transit gateway attachments? if no attachments, how VPCs are going to communicate onprem through the transit gateway?
Show 2 more comments
  1. Andy_09 👍 7
    Option A
  2. Umuntu 👍 6
    A is the best solution

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide