All spoke VPCs must reach a shared-services VPC but NOT each other, through a Transit Gateway. What implements this segmentation?
A.Security groups in each spoke
SGs filter traffic — routing still allows the paths.
B.Separate TGW route tables — spokes associate to a table that only propagates shared-services routes
Correct. TGW route tables = routing segmentation.
C.VPC peering instead of TGW
Peering at scale is the mesh problem TGW solves.
D.NACLs in the shared-services VPC
NACLs filter; they don't segment the routing domain.
Why this answer
TGW route tables control which attachments can reach which — the hub-spoke isolation pattern puts spokes in one table (route only to shared services) and shared services in another (routes back to all spokes). Security groups control instance traffic, not routing reachability.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Hybrid Connectivity practice session.
Practice Hybrid Connectivity