An organization runs 80 spoke VPCs. Security requires that all outbound internet traffic pass through centrally managed inspection appliances — without deploying NAT and firewalls in every VPC. Which architecture fits?
A.Give each VPC its own NAT gateway and security groups
80× duplicated NAT/firewall stacks — cost and ops nightmare.
B.Transit Gateway with a dedicated egress VPC containing NAT gateways and Network Firewall/GWLB inspection
Correct. TGW hub + single inspected egress path.
C.VPC peering all VPCs to a shared VPC
Peering is non-transitive — 80-VPC mesh is unmanageable.
D.A single NAT instance in the largest VPC
Single instance = bandwidth bottleneck + single point of failure.
Why this answer
The centralized-egress pattern routes all spoke traffic through Transit Gateway into a dedicated egress VPC where NAT + inspection live once — spokes have no internet route of their own. This is the standard multi-account network design; per-VPC appliances don't scale operationally, and peering is non-transitive mesh chaos at 80 VPCs.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Complex Solution Design practice session.
Practice Complex Solution Design