TL;DR: Transit Gateway, because peering is non-transitive and forty VPCs needs 780 peering connections to be fully meshed. PrivateLink is not really an alternative: it exposes a single service endpoint rather than connecting networks, and it is the right answer when you want exactly that and no routing relationship at all.
How to approach it
Do the arithmetic on the mesh in your first breath, because the number decides it. Then distinguish PrivateLink properly: it is often listed as a third connectivity option when it is a different category of thing, exposing one service rather than joining two networks.
A strong answer
VPC peering is a one-to-one routing relationship, and it is deliberately non-transitive: if A peers with B and B peers with C, A cannot reach C. There is no transit through a peer, by design, because AWS will not let your VPC become someone else's router. So full connectivity needs a connection per pair, which is n(n-1)/2. For forty VPCs that is 780 connections and 40 route tables to maintain, and every new VPC adds another 40. Automation can manage it, but route ownership, quotas and change review become substantial overhead.
Peering remains right for a small number of stable, high-throughput relationships: no separate peering data-processing charge and a direct network path. Inter-AZ or inter-Region data-transfer charges can still apply; check the actual topology.
Transit Gateway is a managed hub. Each VPC attaches once, so forty attachments rather than 780 connections, and routing is transitive through the hub. It supports VPN attachments and connects to Direct Connect through a Direct Connect gateway, so on-premises joins the same topology rather than needing its own mesh. Route tables on the gateway let you segment: a shared-services VPC reachable by everyone, production and development unable to reach each other, and an inspection VPC in the path for egress filtering. That segmentation is usually the real reason to adopt it beyond the connection count.
The costs to state honestly: an hourly charge per attachment and a per-GB data processing charge, which at high volume is a meaningful line item. It is also a regional construct, so multi-region means peering gateways together. And it becomes a blast-radius concentration point, so the route tables are worth treating as production configuration.
PrivateLink is a different thing. It does not connect networks; it projects a single service into your VPC as an interface endpoint with an address in your subnet. Traffic is unidirectional to that service, there is no route between the two VPCs, and overlapping CIDRs do not matter because no routing relationship exists. That last property makes it the right answer for consuming a SaaS or partner service, or exposing one of yours to many consumers, especially after an acquisition where address space collides.
So the design: Transit Gateway as the backbone with segmented route tables, Direct Connect through a Direct Connect gateway or a VPN attachment for on-premises, peering retained only where a specific pair needs raw throughput, and PrivateLink for service-level exposure where you deliberately do not want a network relationship.
What interviewers probe next
"What if two VPCs have overlapping CIDRs?" Transit Gateway cannot route between them. PrivateLink can, because it never routes. Otherwise you re-address or NAT.
"How does route propagation work?" Attachments can propagate their routes into a gateway route table automatically, and associations decide which table an attachment uses. Separating association from propagation is what gives you segmentation.
"When is centralised egress worth it?" When you want one inspection point and one set of NAT gateways rather than per-VPC. It can reduce NAT gateway count and centralize filtering, but include TGW processing and cross-AZ transfer costs as well as availability. AWS hybrid connectivity costs.
Common mistakes
Not knowing peering is non-transitive, which is the fact the question is built on.
Presenting PrivateLink as an alternative for network connectivity rather than service exposure.
Omitting cost. At forty VPCs the data processing charges are large enough to belong in the design conversation.