SAP-C02
Deep Dive
Networking questions in the SAP-C02 always involve multiple accounts and VPCs. Understanding when to use VPC Peering, Transit Gateway, PrivateLink or RAM — and their limitations — is essential for the professional-level exam.
Contents
| Service | Topology | Transitive | Cross-account | Best for |
|---|---|---|---|---|
| VPC Peering | Point-to-point (mesh) | NO | Yes (with acceptance) | Few VPCs, low volume, same region or inter-region |
| Transit Gateway | Hub-and-spoke | YES | Yes (via RAM) | Many VPCs, centralized traffic, on-premises + cloud |
| PrivateLink | One-directional | N/A | Yes (VPC Endpoint) | Exposing private services/APIs across accounts without peering |
| AWS RAM | Shared subnets | N/A | Yes (org or account) | Sharing subnets of a central VPC with other accounts |
| VPN Gateway | Site-to-site | With TGW | Yes | Connecting on-premises to a single VPC or via TGW |
| Direct Connect | Dedicated (physical) | With TGW | Yes | High-performance private connectivity from on-premises |
VPC Peering establishes a private, point-to-point network connection between two VPCs. Traffic never crosses the public internet — it stays on AWS's backbone network.
Features
Critical limitations
Exam golden rule
VPC Peering is ideal for a handful of VPCs needing bidirectional communication. When the scenario mentions "dozens or hundreds of VPCs" or "communication with on-premises from multiple VPCs" → Transit Gateway.
Transit Gateway (TGW) is a managed regional router that acts as a central hub. Every VPC and on-premises connection attaches to the TGW, which routes traffic between them. It supports up to 5,000 attachments.
Supported attachments
TGW route tables
Advanced features
The TGW lets you segment traffic with multiple route tables. It's the pattern for isolating prod from dev, or building inspection zones with security appliances.
Pattern: Prod/Dev isolation
Two route tables: one associated with Prod VPCs and another with Dev VPCs. Prod routes don't propagate to Dev and vice versa. Both can reach a Shared-Services VPC.
Pattern: inline inspection with a firewall
All E-W traffic passes through an inspection VPC running AWS Network Firewall. TGW Appliance Mode keeps flow symmetry for stateful inspection.
PrivateLink lets you expose a service in one VPC to other VPCs (or accounts) without creating VPC Peering or exposing the whole VPC. The consumer creates an Interface VPC Endpoint, which appears as an ENI (Elastic Network Interface) in its own VPC.
| Component | Description | Where it lives |
|---|---|---|
| Endpoint Service (Provider) | An NLB in front of the service you want to expose. The provider creates the Endpoint Service. | Service provider's VPC |
| Interface VPC Endpoint (Consumer) | An ENI in the consumer's subnet. DNS resolves to the ENI's private IP. | Consumer's VPC |
| Account allowlist | The provider can restrict which accounts or principals can create endpoints to the service. | Endpoint Service configuration |
| Private DNS | Enabling Private DNS overrides the service's public DNS (e.g. api.svc.com → ENI's private IP) | Consumer's VPC |
When to use PrivateLink vs VPC Peering
PrivateLink when:
VPC Peering when:
RAM lets you share AWS resources between accounts in the same organization or with external accounts. The most common networking use case is sharing subnets of a shared VPC.
VPC Subnets
Share subnets from a central VPC. Member accounts deploy resources into those subnets.
Transit Gateway
Share a central TGW with multiple accounts instead of creating one TGW per account.
Route 53 Resolver Rules
Share forward/conditional DNS rules for centralized DNS resolution.
Prefix Lists
Share centrally managed CIDR lists for SGs and route tables.
Direct Connect Gateway + TGW
To connect on-premises to multiple VPCs across multiple accounts and regions, the recommended architecture is: DX → DXGW → TGW → VPCs.
Site-to-Site VPN at scale with ECMP
AWS VPN with TGW supports ECMP (Equal-Cost Multi-Path) to aggregate multiple VPN tunnels and increase throughput.
Do you need to connect 2–5 VPCs with full-mesh communication?
→ VPC Peering
Do you have 10+ VPCs, or need to connect on-premises to multiple VPCs?
→ Transit Gateway
Do you want to expose a specific microservice to other accounts without sharing the whole VPC?
→ PrivateLink
Do you need to share subnets from a central VPC across accounts in the org?
→ AWS RAM with VPC Sharing
Do you need dedicated private connectivity from your own datacenter to AWS?
→ Direct Connect (+ DXGW + TGW for scale)
Do the VPC CIDRs overlap?
→ PrivateLink (VPC Peering and TGW require non-overlapping CIDRs)
Trap: "Transit Gateway is transitive like VPC Peering"
Reality: TGW IS transitive — that's its key advantage over VPC Peering. VPC Peering is the one that is NOT transitive.
Trap: "PrivateLink requires non-overlapping CIDRs"
Reality: FALSE. PrivateLink works even with overlapping CIDRs — that's one of its main advantages over Peering.
Trap: "A single Direct Connect can connect directly to multiple VPCs in different regions without a DXGW"
Reality: FALSE. You need a Direct Connect Gateway (DXGW) to connect a DX to VPCs across multiple regions.
Trap: "RAM only works within the same organization"
Reality: RAM can also share resources with accounts outside the organization (requires manual acceptance).
Did you get this topic?
Test what you just learned
A company has 50 VPCs spread across 5 AWS accounts within an organization. Every VPC needs to communicate with the others and also reach an on-premises datacenter over an existing Direct Connect. The network team wants a centralized architecture that minimizes operational complexity. What is the most appropriate solution?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.