SOA-C03 practice question: Troubleshooting VPC connectivity (2 of 2)
Networking and Content Delivery A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A public library connects two VPCs, Catalog (10.10.0.0/16) and Archive (10.20.0.0/16), through a transit gateway.
Both attachments are associated with the same transit gateway route table. Each VPC's route table sends the other VPC's CIDR to the transit gateway, and security groups allow the traffic.
Packets from Archive reach Catalog but no replies return, and requests from Catalog to Archive time out. The transit gateway route table contains only a propagated route for 10.10.0.0/16.
What should a CloudOps engineer do?
Choose one answer.
AA. Create a VPC peering connection between the two VPCs and remove both attachments from the transit gateway.
BB. Propagate the Archive attachment to the transit gateway route table, or add a static route to it.
CC. Associate the Archive VPC attachment with a second, separate transit gateway route table.
DD. Add a route for 10.10.0.0/16 to the Catalog VPC's route table that points to the transit gateway attachment.
Show the answer and explanation
Answer: B
A. Wrong: Peering would work, but it replaces the existing design instead of fixing a missing route. The transit gateway is already in place for this connection. Learn more: What is VPC peering? (opens in a new tab)
B. Right: Correct. The transit gateway route table has no route to 10.20.0.0/16, so traffic toward Archive is dropped at the transit gateway. Propagating the Archive attachment, or adding a static route, completes the path. Learn more: Transit gateway route tables (opens in a new tab)
C. Wrong: Association decides which route table is used for traffic arriving from an attachment. The problem is that no route table has a route to Archive, so a new empty table would not help. Learn more: Transit gateway route tables (opens in a new tab)
Transit gateway traffic needs a route at every hop: in the source VPC's route table, in the transit gateway route table associated with the source attachment, and back again for replies. Here the transit gateway route table lacks the Archive CIDR. Propagation from the Archive attachment, or a static route, fixes it. Reachability Analyzer can find this kind of missing route quickly.
Want more on Troubleshooting VPC connectivity? The 5 full-length practice sets have 9 more Troubleshooting VPC connectivity questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →