A company has three VPCs: production, nonproduction, and shared-services. Both production and nonproduction VPCs must be able to communicate with the shared-services VPC, but production and nonproduction must not communicate with each other. A transit gateway is used for connectivity. Which transit gateway route table configuration will enforce these requirements?

The correct configuration uses two transit gateway route tables to achieve the desired isolation and communication. The first route table, associated with the production and nonproduction VPC attachments, only propagates routes from the shared-services VPC. This allows production and nonproduction to reach shared services. Crucially, because it doesn't propagate routes between production and nonproduction, they cannot communicate directly. The second route table, associated with the shared-services VPC attachment, propagates routes from both production and nonproduction VPCs, enabling shared services to initiate communication with both. Incorrect options: Propagating routes for each VPC in the first route table would allow direct communication between production and nonproduction, violating the requirement. Associating all VPC attachments in one route table and propagating only shared-services routes would prevent shared services from initiating communication with production or nonproduction. Disabling route propagation entirely for the production and nonproduction attachments would prevent them from reaching shared services.