ANS-C01 Question 337
Select 3Your company has a hybrid network setup with an on-premises data center connected to AWS using an AWS Site-to-Site VPN. You have configured a Virtual Private Gateway on AWS and a Customer Gateway on-premises. However, the on-premises systems cannot communicate with instances in a private subnet of your VPC. Upon investigation, you find that the VPN is showing as 'UP' in the AWS Management Console. Which of the following steps would most likely resolve this issue?
- A
Ensure that the route table of the subnet includes a route pointing to the Virtual Private Gateway for the on-premises CIDR range.
- B
Add a Security Group rule to allow inbound traffic from the on-premises CIDR range.
- C
Update the on-premises router to include a static route for the VPC CIDR range pointing to the Customer Gateway.
- D
Modify the Network ACL associated with the private subnet to allow traffic from the on-premises CIDR range.
- E
Recreate the VPN connection in AWS as the current connection must be faulty.
Show answer and explanation
Correct answers: A, B, C
Explanation
In a hybrid network setup, proper routing and security configurations are critical for connectivity. Subnet route tables need to direct traffic to the Virtual Private Gateway for the on-premises CIDR. Security Groups must allow inbound traffic from the on-premises CIDR. Additionally, the on-premises router must have a static route pointing to the VPC CIDR via the Customer Gateway. These combined configurations ensure bidirectional communication between the VPC and the on-premises network.
- A. Correct.
Correct: The route table for the subnet must direct traffic destined for the on-premises CIDR range to the Virtual Private Gateway. Without this, traffic won't be routed correctly.
- B. Correct.
Correct: Security Groups act as stateful firewalls, and without a rule allowing inbound traffic from the on-premises CIDR, instances in the subnet cannot receive traffic from on-premises systems.
- C. Correct.
Correct: The on-premises router must have a static route for the VPC CIDR pointing to the Customer Gateway to ensure traffic is properly routed to the VPN tunnel.
- D. Incorrect.
Incorrect: Network ACLs are stateless, but modifying them is unnecessary if they already allow the relevant traffic. Security Groups typically handle this for instances in a VPC.
- E. Incorrect.
Incorrect: Recreating the VPN connection is unnecessary since the VPN is already 'UP,' indicating a connectivity issue rather than a problem with the VPN setup.