SOA-C02 Question 286
Select 4An organization has set up an AWS Direct Connect connection to establish a hybrid connection between their on-premises data center and their VPC. The organization is experiencing issues where only certain subnets in the VPC are reachable from their on-premises network. Which of the following steps should you take to troubleshoot and resolve the issue?
- A
Verify that the associated route table for the VPC includes routes for the on-premises network pointing to the virtual private gateway.
- B
Ensure the on-premises router has the correct static or dynamic routes configured for the VPC subnets.
- C
Check the security group rules to ensure traffic from the on-premises CIDR block is allowed to the affected subnets.
- D
Review the Network ACLs (NACLs) for the subnets to verify they allow inbound and outbound traffic from the on-premises CIDR block.
- E
Increase the MTU size on the Direct Connect interface to accommodate hybrid traffic.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To resolve hybrid connectivity issues where only certain subnets are unreachable, proper routing must be configured both in the VPC and on the on-premises router. Additionally, access control mechanisms such as security groups and NACLs must allow traffic from the on-premises network. MTU size adjustments are not relevant in this scenario as they do not directly address subnet reachability issues.
- A. Correct.
If the VPC route table does not have routes pointing to the virtual private gateway for the on-premises network, traffic will not be routed correctly. This is a critical step.
- B. Correct.
The on-premises router must have the correct routes for the VPC subnets. If the necessary routes are missing, certain subnets will not be reachable.
- C. Correct.
Security groups control inbound and outbound traffic at the instance level. If the rules are restrictive, traffic from the on-premises network might be blocked.
- D. Correct.
Network ACLs act as a firewall at the subnet level. If the NACLs are not configured to allow traffic from the on-premises network's CIDR block, communication will fail.
- E. Incorrect.
The MTU size does not directly affect the reachability of subnets, and increasing it unnecessarily can cause fragmentation issues. This is not relevant to the given issue.