A SysOps administrator is troubleshooting a connectivity issue between two VPCs: VPC A () and VPC B (). The VPCs were previously communicating successfully via a VPC peering connection. After a recent configuration cleanup, instances in VPC A can no longer reach instances in VPC B. The administrator checks the route table for VPC A's subnet and finds the following entry:
| Destination | Target | Status |
|---|---|---|
| local | Active | |
| pcx-0a1b2c3d4e5f6g7h8 | Blackhole |
Which action must the administrator take to restore connectivity?
- AUpdate the Network Access Control List (NACL) rules for VPC A to explicitly allow outbound traffic to VPC B's CIDR block on ephemeral ports (), which will change the status to Active.
- BAdd a default route () pointing to an Internet Gateway in VPC A's route table to allow the peering connection to resolve the destination subnet's IP addresses over the public internet.
- Update the route table for VPC A to target the active VPC peering connection ID, and ensure that the route table in VPC B is also updated to target the active peering connection.Answer
- DAssociate the subnet route tables in both VPCs with a Gateway VPC Endpoint to redirect the peering traffic and bypass the invalid routing target.
Answer
Update the route table for VPC A to target the active VPC peering connection ID, and ensure that the route table in VPC B is also updated to target the active peering connection.
The correct answer is to update the route tables in both VPCs to target the active VPC peering connection ID. A route status of Blackhole indicates that the target of the route (such as a deleted peering connection or network interface) is no longer available. Updating the route table with the correct, active peering connection ID restores the route's status to Active. Because VPC peering requires bidirectional routing, the route table in the peer VPC must also be updated.
Step-by-Step Solution
Key Concept
VPC Peering Routing and Blackhole Route Status