ANS-C01 Question 174
Single answerYour company has two VPCs in separate AWS accounts: VPC-A (10.0.0.0/16) and VPC-B (10.0.0.0/16). You need to establish communication between the two VPCs to enable data sharing between applications hosted in each. However, the overlapping CIDR blocks prevent a direct VPC peering connection. What solution would allow communication between these VPCs while avoiding IP address conflicts?
- A
Use a Transit Gateway to connect the two VPCs and configure route tables to handle overlapping CIDR blocks.
- B
Establish a VPN connection between the VPCs and use Network Address Translation (NAT) to resolve the overlapping IP space.
- C
Reconfigure the CIDR block of one of the VPCs to remove the overlap and then establish a VPC peering connection.
- D
Use AWS PrivateLink to create an endpoint in one VPC that can be accessed by resources in the other VPC.
Show answer and explanation
Correct answer: B
Explanation
When two VPCs have overlapping CIDR ranges, direct communication via VPC peering or Transit Gateway is not possible due to routing conflicts. A VPN connection with NAT can translate the IP address ranges of one VPC to a non-overlapping range, allowing communication without needing to modify the existing CIDR blocks. This approach is non-disruptive and suitable for scenarios where VPC CIDR ranges cannot be changed.
- A. Incorrect.
Transit Gateway does not natively handle overlapping CIDR blocks. Without NAT or reconfiguration of IP ranges, the overlapping IP addresses will cause routing conflicts.
- B. Correct.
This is the correct solution. Using a VPN connection with NAT allows you to map overlapping IP addresses to non-overlapping ones, enabling communication between the VPCs without modifying their CIDR blocks.
- C. Incorrect.
Reconfiguring the CIDR block of a VPC is a highly disruptive process that requires rebuilding the VPC, which is not practical in most cases.
- D. Incorrect.
AWS PrivateLink is used to create private endpoints for services but does not address overlapping CIDR blocks or enable general communication between VPCs.