CV0-003 · Question #311
A cloud administrator has configured a connection between two virtual private cloud environments at a public cloud provider that are each in different accounts. The administrator has configured the ac
The correct answer is D. The routing tables have not been updated correctly.. In VPC peering, establishing the peering connection alone is insufficient - routing tables in each VPC must be explicitly updated to direct traffic destined for the peer VPC CIDR through the peering connection.
Question
A cloud administrator has configured a connection between two virtual private cloud environments at a public cloud provider that are each in different accounts. The administrator has configured the accounts correctly so they can connect to each other's resources. Both cloud environments have policies that allow anyone from 0.0.0.0/0 on TCP port 22. The following table shows the network configuration information:
However, the administrator is unable to establish an SSH connection from a server in 10.250.40.100 to 10.250.48.214. Which of the following is the MOST likely issue?
Options
- AThe network ACL is not configured to allow SSH access.
- BThe IP configuration on one of the servers is incorrect.
- CThe administrator does not have sufficient credentials.
- DThe routing tables have not been updated correctly.
How the community answered
(22 responses)- A5% (1)
- B23% (5)
- C14% (3)
- D59% (13)
Why each option
In VPC peering, establishing the peering connection alone is insufficient - routing tables in each VPC must be explicitly updated to direct traffic destined for the peer VPC CIDR through the peering connection.
The problem states both environments have policies allowing 0.0.0.0/0 on TCP port 22, so the network ACL is already configured to permit SSH traffic.
Both servers have valid RFC 1918 private IP addresses within their respective subnets, and the scenario gives no indication of an IP address misconfiguration.
Insufficient credentials would result in an authentication failure after a TCP connection is established, not a failure to reach the destination host at the network layer.
VPC peering requires that routing tables in both VPCs be explicitly updated with route entries pointing to the peer VPC CIDR block via the peering connection ID. Without these routes, traffic originating from 10.250.40.100 has no forwarding path to reach 10.250.48.214, even though the peering connection is established and security policies allow SSH on TCP 22. Missing or misconfigured route table entries are the most common cause of connectivity failure in VPC peering setups.
Concept tested: VPC peering routing table configuration for cross-account connectivity
Source: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-routing.html
Topics
Community Discussion
No community discussion yet for this question.