Transit Gateway for Multi-VPC Interconnectivity

SAA-C03 By islever Editorial Last updated

Determine high-performing and/or scalable network architectures.

Short answer

D Deploy a transit gateway with associations between the transit gateway and the application VPCs and the shared services VPC.

Question

A company is migrating five on-premises applications to VPCs in the AWS Cloud. Each application is currently deployed in isolated virtual networks on premises and should be deployed similarly in the AWS Cloud. The applications need to reach a shared services VPC. All the applications must be able to communicate with each other. If the migration is successful, the company will repeat the migration process for more than 100 applications. Which solution will meet these requirements with the LEAST administrative overhead?
  1. Deploy software VPN tunnels between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC.
  2. Deploy VPC peering connections between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC through the peering connection.
  3. Deploy an AWS Direct Connect connection between the application VPCs and the shared services VPAdd routes from the application VPCs in their subnets to the shared services VPC and the applications VPCs. Add routes from the shared services VPC subnets to the applications VPCs.
  4. Deploy a transit gateway with associations between the transit gateway and the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets and the application VPCs to the shared services VPC through the transit gateway. Correct Answer

Key Takeaways

The question tests the ability to choose a networking solution that scales efficiently; the trap is selecting VPC peering, which creates an unmanageable mesh of connections at scale.

AWS Transit Gateway provides a centralized hub-and-spoke model to connect multiple VPCs with minimal administrative overhead, ideal for scaling to 100+ applications.

Common mistake: VPC Peering (B) is often chosen because it is simpler for small numbers of VPCs, but it requires individual peering connections and route tables for every pair, leading to high administrative overhead as the number of VPCs grows.

Expert Analysis

Why the Answer Is Correct

Transit Gateway (D) is the correct choice because it acts as a central hub that simplifies connectivity between many VPCs. Instead of creating point-to-point links, you attach each application VPC and the shared services VPC to the single Transit Gateway. This drastically reduces the number of routes and configurations needed compared to other methods.

Why the Other Options Are Wrong

VPC Peering (B) requires a full mesh of connections if all VPCs need to talk to each other (N*(N-1)/2 connections), which becomes unmanageable for 100+ VPCs. Direct Connect (C) connects on-premises networks to AWS, not VPCs to VPCs within the cloud. Software VPN tunnels (A) add significant management overhead for encryption and tunnel maintenance.

Community Comment Notes

Community consensus strongly favors D, noting that Transit Gateway is designed for scalability and reduced administrative overhead. As one user noted, "It will allow for inter-VPC communication for all 5 applications/VPC... and in the future it will be easy to allow for inter-communication between even 100 VPCs". Another comment highlights that "the LEAST administrative overhead = transit gateway".

Official Reference

https://docs.aws.amazon.com/vpc/latest/tgw/what-is-aws-transit-gateway.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about connecting many VPCs with least administrative overhead, always consider Transit Gateway first. Remember that VPC Peering does not support transitive routing and scales poorly due to the mesh requirement.

Frequently Asked Questions

Why is VPC Peering not suitable for 100+ VPCs?

VPC Peering requires a full mesh of connections for all-to-all communication, leading to O(N^2) complexity and unmanageable route tables.

Does Transit Gateway support transitive routing?

Yes, Transit Gateway allows traffic to flow between any attached VPCs without needing direct peering connections between them.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Scheldon 👍 5 Answered D
    Answer: D https://aws.amazon.com/transit-gateway/ Looks like the best solution would be transit gateway. It will allow for inter-VPC communication for all 5 applications/VPC, reach shared resource/VPC and in the future it will be easy to allow for inter-communication between even 100 VPCs (applications)
  2. emakid 👍 3 Answered D
    AWS Transit Gateway: Centralized Connectivity: AWS Transit Gateway provides a hub-and-spoke model for connecting multiple VPCs, simplifying network management by providing a single point of connectivity for all VPCs. Scalability: It is designed to handle many VPCs, making it suitable for scaling beyond the initial five applications to more than 100 applications. Reduced Administrative Overhead: Managing VPC peering connections or VPN tunnels for each pair of VPCs would become complex and difficult to manage at scale. Transit Gateway simplifies this by providing centralized routing and connectivity.
  3. 0bdf3af 👍 3
    D. https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/transit-gateway.html
  4. muhammadahmer36 👍 2 Answered D
    D. Deploy a transit gateway with associations between the transit gateway and the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets and the application VPCs to the shared services VPC through the transit gateway.
  5. mk168898 👍 2
    each application needs to be in their own VPC and can communicate with each other => transit gateway
Show 3 more comments
  1. DanielWuTRT 👍 2 Answered D
    the LEAST administrative overhead = transit gateway
  2. LeonSauveterre 👍 1 Answered D
    A - VPN Tunnels: High administrative overhead. Requires individual tunnel setup and routing configuration for each VPC, making scaling to 100+ VPCs inefficient. B - VPC Peering: Moderate overhead. Requires manual peering for each pair of VPCs and routing configurations, which becomes harder to manage as more VPCs are added. C - Direct Connect: High cost and complexity. Direct Connect is typically used for hybrid cloud setups or data center connectivity but is costly and harder to manage at large scale. Not suitable for connecting numerous VPCs in the AWS Cloud. D - Transit Gateway: Lowest overhead. Acts as a centralized hub for managing inter-VPC communication and simplifies the process of routing between VPCs. It is highly scalable and reduces the complexity of adding new VPCs, and optimal for managing large-scale environments.
  3. Hkayne 👍 1 Answered B
    Correct answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide