AWS Transit Gateway for Centralized On-Premises Connectivity
Short answer
D Configure AWS Transit Gateway between the accounts. Assign DX to the transit gateway and route network traffic to the on-premises servers.
Question
Key Takeaways
It tests the ability to choose a centralized networking service that minimizes operational overhead compared to per-account Direct Connect or VPN connections.
This question addresses designing scalable network architectures using AWS Transit Gateway to centralize connectivity between multiple VPCs and on-premises data centers via Direct Connect.
Common mistake: Candidates often select Option A (Direct Connect in each account) because they focus on direct connectivity but ignore the 'least operational overhead' requirement, which makes managing individual DX connections inefficient.
Expert Analysis
Why the Answer Is Correct
The correct answer is D. AWS Transit Gateway acts as a central hub that can attach multiple VPCs from different accounts (using Resource Sharing) and connect them to on-premises networks via a single Direct Connect gateway attachment. This architecture allows new accounts to quickly join the network by simply attaching their VPCs to the Transit Gateway, eliminating the need to provision separate physical connections or complex routing policies for each account. This directly satisfies the requirements for quick, cost-effective, consistent access with the least operational overhead.
Why the Other Options Are Wrong
Option A is incorrect because creating a separate Direct Connect connection for each new account involves significant provisioning time, recurring costs, and management overhead, violating the 'least operational overhead' constraint. Option B is incorrect because VPC endpoints are designed to privately connect to AWS services (like S3 or DynamoDB), not to on-premises resources like directory services or DNS. Option C is incorrect because while VPNs are cost-effective, managing individual IPsec VPNs for every new account introduces significant configuration complexity and latency, making it less efficient than a centralized Transit Gateway solution for scaling.
Community Comment Notes
Community consensus strongly supports Option D. As LeonSauveterre noted, "Managing separate DX connections for every account is too much work," highlighting the operational burden of Option A. JA2018 emphasized that Transit Gateway "centralizes network management, eliminating the need to create separate... connections," which aligns perfectly with the exam's focus on scalability and reduced overhead.
Official Reference
https://docs.aws.amazon.com/transit-gateway/latest/userguide/what-is-aws-transit-gateway.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When you see keywords like 'multiple accounts,' 'centralized,' 'scalable,' and 'least operational overhead' in the context of VPC networking, immediately consider AWS Transit Gateway. It is the standard solution for simplifying multi-VPC and hybrid cloud connectivity.
Frequently Asked Questions
Can Transit Gateway connect to on-premises Direct Connect?
Why not use individual VPNs for each new account?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
LeonSauveterre 👍 3 Answered DNew AWS accounts need consistent, quick, and cost-effective access to these services, so we can't do something for each of these accounts. We should find a way to manage these accounts fast. A - Managing separate DX connections for every account is too much work and DX connections are expensive. B - VPC endpoints are for accessing AWS services, not on-premises services. C - Managing individual VPNs for multiple accounts is too much work and VPNs bring more latency. D - Transit Gateway simplifies the network by acting as a hub for all VPCs and the on-premises network. Instead of multiple DX or VPN connections, you're using one centralized DX connection with Transit Gateway. The best part is that you can easily add new accounts or VPCs without reconfiguring DX or VPN connections.
-
JA2018 👍 1 Answered DI will choose Option D for the following reasons: #Least operational overhead: - Using a Transit Gateway centralizes network management, eliminating the need to create separate DX connections or VPNs for each new account, significantly reducing operational overhead. #Scalability: - With a Transit Gateway, you can easily add new accounts to the network without modifying existing configurations, making it ideal for scenarios with frequent account creation. #Cost-effective: - While creating a dedicated DX connection for each account might seem quick, it can become expensive, especially when dealing with a large number of accounts.
-
aragon_saa 👍 7 Answered DAnswer is D
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →