SOA-C03 - Networking and Content Delivery (18% of the exam) - Section 5.2

Implement private connectivity using AWS PrivateLink, VPC endpoints and AWS Transit Gateway, and audit network protection services such as AWS WAF, AWS Shield and AWS Network Firewall.

Implement private connectivity to AWS services and third-party endpoints using AWS PrivateLink and VPC endpoints, and connect multiple VPCs at scale through AWS Transit Gateway. Apply AWS WAF, AWS Shield, and AWS Network Firewall to inspect and filter traffic at the edge and within the network.

AWS PrivateLinkVPC endpointsAWS Transit GatewayAWS Network Firewall

Practice question for this objective

Free sampleNetworking and Content Deliverymedium

Two VPCs are attached to the same AWS Transit Gateway, and each attachment is associated with the Transit Gateway default route table. Instances in the two VPCs still cannot reach each other across the Transit Gateway, although each VPC has internet access. The Transit Gateway route table shows the attachments associated but no routes to the opposite VPC CIDRs. Which change restores VPC-to-VPC connectivity through the Transit Gateway?

ADetach and reattach each VPC to the Transit Gateway so the attachments re-register and the gateway rebuilds the missing routes to the opposite VPC CIDRs automatically.
BAdd a route in each VPC subnet route table that sends the internet CIDR to the Transit Gateway so cross-VPC packets are forwarded over the existing internet path.
CEnable route propagation for the attachments on the Transit Gateway route table, and add a route in each VPC subnet route table for the other VPC CIDR pointing at the Transit Gateway. Correct
DReplace the Transit Gateway with VPC peering between the two VPCs, then add a peering route in each subnet route table because peering forwards cross-VPC traffic without route tables on the gateway.

Restore Transit Gateway VPC-to-VPC connectivity by propagating attachment routes into the gateway route table and adding matching VPC subnet routes. Cross-VPC traffic over a Transit Gateway needs routes in two places. The Transit Gateway route table must contain each VPC CIDR, which propagation supplies from the attachments, and each VPC subnet route table must send the other VPC CIDR to the Transit Gateway. The scenario shows propagation is missing because no opposite-VPC routes appear, so enabling propagation and adding the subnet routes is the targeted fix; reattaching, misrouting the internet CIDR, or switching to peering do not address the missing routes.

Why A is wrong: Reattaching does not change whether route propagation is enabled, so the Transit Gateway route table would still lack the opposite VPC routes and the cross-VPC traffic would continue to fail.

Why B is wrong: Routing the internet CIDR to the Transit Gateway misdirects general traffic and still provides no Transit Gateway route between the specific VPC CIDRs, so VPC-to-VPC reachability is not restored.

Why C is correct: Propagation populates the Transit Gateway route table with each VPC CIDR, and the subnet route entries send cross-VPC traffic to the gateway, together giving the gateway and the VPCs the routes needed to connect.

Why D is wrong: Discarding the Transit Gateway for peering is unnecessary rework when the attachments already exist; the real gap is the missing propagated and subnet routes, which peering does not address.

See more SOA-C03 practice questions, answers explained.

Exam traps in Networking and Content Delivery

Answers that look right on this material and are not. Each one is a distractor from a different question in the SOA-C03 bank for this domain.

It publishes a Route 53 public hosted zone for the service so that any network, including the peered VPC, resolves the default service hostname to the endpoint's private addresses automatically.
Why it is wrong: Private DNS creates a private hosted zone scoped to the endpoint's own VPC, not a public zone, so peered or external networks are unaffected and continue resolving the service name over the public path.
Establish a VPC peering connection from the vendor VPC to each customer VPC and share the application's private addresses so consumers route directly to the Network Load Balancer.
Why it is wrong: Peering requires non-overlapping CIDR ranges, route table edits in every VPC, and a mesh of connections that does not scale to many consumers, so it fails the no-route-change and overlap-free requirements.
VPC peering, creating a peering connection between every pair of VPCs and adding the matching routes so that all fifteen VPCs can reach one another across both Regions.
Why it is wrong: Full-mesh peering needs a connection for every pair of VPCs and grows quadratically, peering is non-transitive so it gives no central segmentation, which is the scaling problem the team wants to avoid.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.