ANS-C01 Question 180
Select 3Your company has established a hybrid architecture where an on-premises data center is connected to AWS using a Site-to-Site VPN. The on-premises network uses the 192.168.0.0/16 CIDR block, and your VPC in AWS uses the 10.0.0.0/16 CIDR block. Recently, an additional subnet (192.168.100.0/24) was added to the on-premises network. However, resources in AWS cannot access this new subnet. What steps should you take to resolve the connectivity issue?
- A
Update the VPN tunnel configuration to include the new on-premises subnet in the local network settings.
- B
Update the VPC route table to include a route for the 192.168.100.0/24 subnet, pointing to the VPN connection.
- C
Enable VPC peering between the on-premises network and the AWS VPC for the new subnet.
- D
Verify that the on-premises router is advertising the new subnet (192.168.100.0/24) to AWS over BGP.
- E
Modify the VPC CIDR block to include the 192.168.100.0/24 subnet.
Show answer and explanation
Correct answers: A, B, D
Explanation
To resolve the connectivity issue, the new subnet (192.168.100.0/24) must be included in the VPN tunnel configuration and advertised to AWS via BGP. Additionally, the VPC route table must have a route for the new subnet pointing to the VPN connection. These steps ensure that traffic between the on-premises network and AWS can flow correctly. VPC peering and modifying the VPC CIDR block are not applicable in this scenario.
- A. Correct.
Correct. The VPN tunnel configuration must include the new subnet (192.168.100.0/24) in the local network settings to allow communication over the VPN.
- B. Correct.
Correct. The route for the new subnet (192.168.100.0/24) must be added to the VPC route table, pointing to the VPN connection, so traffic can be routed correctly.
- C. Incorrect.
Incorrect. VPC peering is not required for this scenario since the on-premises network is connected to AWS via a Site-to-Site VPN.
- D. Correct.
Correct. The on-premises router must advertise the new subnet (192.168.100.0/24) to AWS over BGP (if BGP is being used) to ensure that AWS is aware of the new route.
- E. Incorrect.
Incorrect. You cannot modify the VPC CIDR block to include on-premises subnets. The VPC and on-premises networks must have non-overlapping CIDR blocks.