AmazonAmazon Advanced Networking Specialty ANS-C01 Certification·EN·Updated 3 Aug 2026
Design a hybrid network to connect a corporate network to 30 VPCs across 3 Regions that must interconnect and have centralized firewall inspection using a security-approved firewall. AWS-to-corporate connectivity must provide at least 2 Gbps. Which architecture meets these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Deploy four 1 Gbps Direct Connect links in different Direct Connect locations to the corporate network. Create a transit VIF on each connection to a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway for each Region. Connect the transit gateways using transit gateway peering attachments. Configure the VIFs to use ECMP. Configure transit gateway route tables to route traffic to an inspection VPC. Deploy the approved firewall to the inspection VPC..
Why this is the answer
The correct option provides high availability and throughput for corporate connectivity by using four 1 Gbps Direct Connect links with ECMP, exceeding the 2 Gbps requirement. Using a Direct Connect gateway with transit VIFs centralizes connectivity to AWS. Deploying a transit gateway in each Region and peering them allows inter-VPC communication across Regions. Centralized firewall inspection is achieved by routing all traffic through an inspection VPC where the approved firewall is deployed.
Incorrect options:
IPsec VPNs typically don't meet the 2 Gbps throughput requirement and introduce higher latency compared to Direct Connect.
Provisioning a Direct Connect to each VPC's virtual private gateway is not scalable for 30 VPCs and doesn't leverage Transit Gateway for centralized routing and inspection.
Two 1 Gbps Direct Connect links might not consistently provide 2 Gbps due to overhead and failover scenarios, and it doesn't explicitly mention inter-regional VPC connectivity via transit gateway peering.