AWS Certified Solutions Architect Professional SAP-C02 Practice Question

Deploying an AWS Transit Gateway (TGW) solves the problem. A TGW acts as a highly available cloud router that natively supports attachments for VPCs, Site-to-Site VPNs, and Direct Connect gateways. By attaching the network-services VPC, the application VPCs, the two VPN connections, and a Direct Connect gateway (for the existing Direct Connect circuit) to the TGW, all networks can communicate through TGW route tables while avoiding the edge-to-edge and transitive-routing limitations of VPC peering.

Incorrect options:

• AWS VPN CloudHub - CloudHub running on a VGW can exchange routes between VPNs and even a Direct Connect private VIF on the same VGW, but it would still be blocked by the "edge-to-edge routing" limitation of VPC peering, so on-premises networks could not reach the application VPCs. CloudHub also scales only to 50 VPNs and lacks the centralized controls and visibility that TGW provides.
• Enable route propagation on the VGW and add static routes - This does not overcome the peering edge-to-edge restriction and provides no central hub for additional VPCs or future connections.
• Third-party virtual router appliances - While technically feasible, this approach adds operational overhead for HA, patching, licensing, and scaling, whereas TGW is a fully managed service purpose-built for this use case.