Examkin

Question

Difficulty: MediumAWS VPN, Direct Connect, and Transit Gateway Management

A SysOps administrator has established hybrid connectivity by connecting an on-premises network to a multi-VPC environment using an AWS Transit Gateway. The administrator configures an AWS Site-to-Site VPN attachment on the Transit Gateway, and both IPsec tunnels are UP with the BGP session active. The Transit Gateway route table has successfully propagated the routes from the on-premises network. However, EC2 instances in a private subnet of one of the VPCs still cannot communicate with the on-premises servers. Which of the following is the most likely cause of this issue?

  1. The route table associated with the private VPC subnet does not contain a route directing traffic destined for the on-premises network to the Transit Gateway.Answer
  2. B
    The route table associated with the private VPC subnet directs all traffic destined for the on-premises network to a NAT Gateway in a public subnet, expecting it to forward the traffic to the Transit Gateway.
  3. C
    The stateless network ACL associated with the private VPC subnet lacks an outbound rule to allow traffic to the ephemeral port range (10241024-6553565535) for initiating connections to the on-premises servers.
  4. D
    The private VPC subnet's route table has not been updated with a Gateway Endpoint association for the Transit Gateway attachment.

Answer

The route table associated with the private VPC subnet does not contain a route directing traffic destined for the on-premises network to the Transit Gateway.
The correct answer is the option stating that the route table associated with the private VPC subnet does not contain a route directing traffic destined for the on-premises network to the Transit Gateway. For traffic to flow from a VPC subnet to an on-premises network via a Transit Gateway, two routing configurations must be in place: the Transit Gateway route table must know how to reach the on-premises CIDR (which was achieved via BGP propagation), and the VPC subnet's route table must have a route pointing the on-premises CIDR to the Transit Gateway attachment. Without the subnet route table entry, traffic will never leave the VPC subnet.

Step-by-Step Solution

1
Analyze the packet path from the EC2 instance to the on-premises network.
The packet starts at the EC2 instance in the private subnet and evaluates the subnet's local route table.
Before a packet can reach the Transit Gateway, the subnet route table must define a route that targets the Transit Gateway for the destination IP prefix.
2
Verify the role of Transit Gateway route table propagation.
Propagation updates the Transit Gateway's internal route table so it knows how to route packets once they arrive at the Transit Gateway.
TGW propagation does not automatically update VPC subnet route tables; those must be managed separately.
3
Identify the missing link in the configuration.
The subnet route table lacks a route pointing the on-premises CIDR block to the Transit Gateway attachment (`tgw-xxxx`).
Adding this route ensures that traffic destined for on-premises is successfully forwarded from the VPC subnet to the Transit Gateway.

Key Concept

VPC Subnet Routing to Transit Gateway
Estimated Time:1m 30s
Rate this question

Topics

AWS VPN, Direct Connect, and Transit Gateway Management

More questions from this topic