A city's hub-and-spoke Transit Gateway design accidentally allows a sandbox account VPC to reach production courts systems through transitive routes. Which control best remediates this?
Select an answer to reveal the explanation.
Short Explanation
Sandbox should not get a backstage pass to the courts. Split Transit Gateway route tables so non-prod spokes never learn production routes. More transitive openness is the opposite of fixing accidental reachability.
Full Explanation
Transit Gateway route tables determine which attachments can reach which prefixes. Isolating sandbox and production onto different route tables—or carefully filtering routes—prevents unwanted transitive paths while still allowing approved shared-services connectivity. Expanding transitive routing, peering sandbox directly to production, or opening production security groups widely increases blast radius instead of remediating it.