A transit gateway connects production, development, and shared-services VPCs. Development must never reach production, while both need shared services. How should this be built?
Show answer and explanation
Answer: A
Transit gateway route tables are built from associations and propagations. An attachment can be associated with exactly one route table, which decides the routes it uses, while its routes can be propagated into several tables, which decides who can reach it.
By putting development and production in different tables and propagating only the shared-services attachment into both, the two environments reach shared services but never each other.
Why the other options are wrong
- B. One table with full propagation creates exactly the unrestricted any-to-any reachability the security requirement forbids.
- C. Full-mesh peering multiplies connections and gives no central segmentation point as the environment count grows.
- D. Disabling propagation leaves attachments with no learned routes, so even shared services become unreachable.
Exam tip. Associations decide what you can reach; propagations decide who can reach you.