Ten VPCs attach to a Transit Gateway. Two 'shared services' VPCs must be reachable by all, but the eight workload VPCs must not reach each other. How is this enforced?
A.Security groups on every workload instance
Security groups filter at instance level — an operational burden across hundreds of resources, and doesn't express topology.
B.Separate TGW route tables: one for workloads propagating only shared services, one for shared services propagating everything
Correct. This hub-spoke pattern via TGW route tables is the standard segmentation design.
C.Network ACLs blocking inter-VPC subnets
NACLs are stateless subnet filters — they'd need constant updates as CIDRs change.
D.One TGW route table with blackhole routes for each workload CIDR
Blackholing workload CIDRs in one table also breaks shared-services return traffic paths in many designs — two tables is the clean pattern.
Why this answer
TGW route tables control which attachments can reach which — associate workload VPCs to a table propagating only shared services, and shared services to a table seeing all CIDRs. Segmentation lives in the routing layer, not security groups.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Operations practice session.
Practice Network Operations