A Transit Gateway connects prod, dev, and shared-services VPCs. Prod and dev must NOT reach each other but both must reach shared services. How is this enforced at the TGW layer?
A.Put all attachments in one TGW route table
One shared table gives full mesh — violates isolation.
B.Separate TGW route tables — prod and dev each propagate to the shared table but not to each other's table
Correct. Route-table design enforces segmentation natively.
C.Security groups only — TGW can't isolate
SGs filter at the instance level — routing-layer isolation is the stronger control.
D.Delete the dev attachment
That removes dev's connectivity entirely.
Why this answer
TGW route tables control which attachments can reach each other: place shared services in a table both prod and dev route to, while keeping prod and dev in separate tables without mutual propagation — segmentation at the routing layer.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the DNS & Edge Routing practice session.
Practice DNS & Edge Routing