CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate Exam Question Walkthrough: AWS Transit Gateway Security Features
Explore a key security feature of AWS Transit Gateway and understand common pitfalls in exam questions.
An important decision in the AWS Certified Solutions Architect - Associate exam involves understanding security features of services like AWS Transit Gateway. Many candidates trip over the details, confusing capabilities and best practices.
The question
An organization is migrating its applications to AWS and wants to ensure that its network architecture follows best practices for security. They are considering using AWS Transit Gateway for connecting multiple VPCs. What is an important security feature of AWS Transit Gateway that they should be aware of?
- A. It automatically encrypts all traffic between VPCs.
- B. It allows the use of security groups for traffic filtering.
- C. It supports segmentation for traffic isolation.
- D. It provides DDoS protection for all connected VPCs.
Think before you scroll
Before choosing an answer, consider what features AWS Transit Gateway provides in terms of security and traffic management. Each option relates to different aspects of network security, but not all apply to Transit Gateway specifically.
The answer
The correct option is C: It supports segmentation for traffic isolation. This feature allows AWS Transit Gateway to connect multiple VPCs while maintaining separate routing domains, effectively isolating traffic between them.
Why the other options lose
- Option A: While traffic can be encrypted between VPCs, AWS Transit Gateway does not automatically encrypt all traffic. Specific configurations are required for encryption, making this option misleading.
- Option B: AWS Transit Gateway does not support the use of security groups for traffic filtering. Security groups are associated with individual VPCs and not with the Transit Gateway, which makes this option incorrect.
- Option D: DDoS protection is not a feature offered by AWS Transit Gateway. While AWS has services like AWS Shield for DDoS protection, this does not apply to Transit Gateway, thus this option is also incorrect.
The concept behind it
Understanding how AWS Transit Gateway operates is crucial for architecting secure environments. The key takeaway is that Transit Gateway supports segmentation, which means you can connect multiple VPCs while keeping their traffic isolated. This principle of segmentation is vital in maintaining secure communication across services in AWS.
Exam trap to remember
Remember: AWS Transit Gateway’s ability to segment traffic is a core feature. Do not confuse it with encryption or filtering capabilities that belong to other services.