AWS Transit Gateway for Scalable Hybrid Connectivity

SAA-C03 By islever Editorial Last updated

Determine high-performing and/or scalable network architectures.

Short answer

C Create a transit gateway with VPC and VPN attachments to simplify administration and scale efficiently.

Question

A company is creating an application. The company stores data from tests of the application in multiple on-premises locations. The company needs to connect the on-premises locations to VPCs in an AWS Region in the AWS Cloud. The number of accounts and VPCs will increase during the next year. The network architecture must simplify the administration of new connections and must provide the ability to scale. Which solution will meet these requirements with the LEAST administrative overhead?
  1. Create a peering connection between the VPCs. Create a VPN connection between the VPCs and the on-premises locations.
  2. Launch an Amazon EC2 instance. On the instance, include VPN software that uses a VPN connection to connect all VPCs and on-premises locations.
  3. Create a transit gateway. Create VPC attachments for the VPC connections. Create VPN attachments for the on-premises connections. Correct Answer
  4. Create an AWS Direct Connect connection between the on-premises locations and a central VPC. Connect the central VPC to other VPCs by using peering connections.

Key Takeaways

The question tests knowledge of centralized networking services, specifically identifying when 'LEAST administrative overhead' with scaling VPCs points to Transit Gateway rather than manual peering or single-point Direct Connect.

Transit Gateway is the optimal solution for connecting multiple on-premises locations to a growing number of VPCs with minimal administrative overhead. This page explains why Transit Gateway outperforms VPC peering and Direct Connect in scalable hybrid architectures.

Common mistake: Many learners choose Option D (Direct Connect + Peering) because they associate Direct Connect with high performance, but fail to realize that VPC peering requires manual configuration for every new VPC, creating significant administrative overhead.

Expert Analysis

Why the Answer Is Correct

Option C is correct because AWS Transit Gateway acts as a central hub that simplifies network connectivity between VPCs and on-premises networks. By using Transit Gateway attachments, you can connect multiple VPCs and on-premises connections (via VPN) without needing to establish individual point-to-point links between every entity. This architecture scales effortlessly as the number of accounts and VPCs increases, requiring only the creation of a new attachment rather than complex routing table updates across multiple peering connections.

Why the Other Options Are Wrong

Option A involves manual VPC peering and individual VPN setups, which creates an 'iBGP mesh' complexity that does not scale well administratively. Option B relies on a self-managed EC2 instance, which introduces a single point of failure, requires patching/management of the OS and software, and lacks the high availability of managed services. Option D uses Direct Connect for speed but still relies on VPC peering to connect to other VPCs; since peering is not transitive and must be created manually for each new VPC, it fails the 'LEAST administrative overhead' requirement as the network grows.

Community Comment Notes

Community consensus strongly supports Option C. Users noted that seeing 'number of VPCs will increase' should immediately trigger the identification of Transit Gateway as the solution for least administrative overhead. One commenter highlighted that while Direct Connect is good, the peering component makes Option D too labor-intensive compared to the hub-and-spoke simplicity of Transit Gateway.

Official Reference

https://docs.aws.amazon.com/vpc/latest/tgw/index.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see keywords like 'multiple on-premises locations,' 'growing number of VPCs,' and 'least administrative overhead,' prioritize Transit Gateway over VPC Peering or Direct Connect alone. Remember that VPC Peering is non-transitive and requires manual management for each new connection, making it poor for large-scale scaling scenarios.

Frequently Asked Questions

Why is Direct Connect + Peering (Option D) not the best choice?

Direct Connect provides dedicated bandwidth, but VPC peering is non-transitive and must be manually created for every new VPC. As the number of VPCs grows, the administrative overhead of managing many peering connections exceeds that of Transit Gateway.

Can I use Transit Gateway with on-premises locations?

Yes, Transit Gateway supports both VPC attachments and Direct Connect attachments (for dedicated lines) or VPN attachments (for IPsec). This allows you to centrally manage all hybrid connectivity from a single gateway.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. 1Alpha1 👍 5 Answered C
    multiple on-premises locations + increasing number of accounts and VPCs --> connections using transit gateway
  2. Andy_09 👍 5
    Think C would be the correct answer here.
  3. EZforeverman 👍 3
    I think its C. LEAST administrative overhead. D can work but AWS direct connection and VPC peering configure require too much administrative overhead
  4. ogerber 👍 3 Answered C
    high number of accounts and VPC to conect to on prem _> exactly the transit gateway use case
  5. KZ06 👍 2
    Hi, Seems like after question 684, the discussion are quite less and seems recent comments. Are these new sets of questions updated? Anyone having any idea around this?
Show 4 more comments
  1. MatAlves 👍 2 Answered C
    Anytime I see "the number of VPCs will increase", I immediately look for "transit gateway" as the least administrative overhead.
  2. LeonSauveterre 👍 1 Answered C
    A - OK but for every new VPC or account, you need to manually create new peering connections and VPNs. Too much administrative overhead! B - Launching EC2s are never an easy job. You not only need to do everything manually mentioned in A, but now you also have to manage the EC2 instance and VPN software. Plus, if the EC2 instance goes down, all connectivity is lost, which is called "single-point of failure". C - Everything seems cool, it's just uhm lightly higher initial setup cost, but it saves time and money in the long run. D - Direct Connect provides fast & reliable connections, but just like A & B, as the number of VPCs grows, you'll go crazy due to all those unmanageable nodes.
  3. Tendu 👍 1 Answered C
    Transit Gateway is a way to go in this situation.
  4. Cali182 👍 3 Answered C
    vote for C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide