AmazonAmazon Advanced Networking Specialty ANS-C01 Certification·EN·Updated 3 Aug 2026
A company hosts infrastructure services in multiple VPCs across multiple accounts in us-west-2. The VPC CIDR blocks do not overlap. The company needs encrypted Site-to-Site VPN connections from its data centers, with each data center routing to the closest AWS edge location. The solution must be highly available and support automatic failover. Which design meets these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Deploy a transit gateway and share it with the other accounts using AWS Resource Access Manager (AWS RAM). Create VPC attachments from each service account to the transit gateway. Add routes to the service VPC route tables that target the transit gateway attachment for on-prem subnets. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the VPN acceleration feature. Configure the customer gateways and establish BGP peering..
Why this is the answer
The correct solution uses a Transit Gateway, which is ideal for connecting multiple VPCs and on-premises networks, simplifying routing and centralizing connectivity. Sharing it via AWS RAM allows other accounts to attach their VPCs. Dynamic routing with BGP peering enables automatic failover and route propagation, crucial for high availability. VPN acceleration improves performance over long distances.