A company currently runs its infrastructure within a VPC in a single Availability Zone. The VPC is connected to the company's on-premises data center through an AWS Site-to-Site VPN connection…

Question

Options

• AAdd a route to the route tables of the new subnets that send on-premises traffic to the virtual
• BCreate a ticket with AWS Support to request adding Availability Zones to the Site-to-Site VPN
• CEstablish a new Site-to-Site VPN connection between a virtual private gateway attached to the
• DReplace the Site-to-Site VPN connection with an AWS Direct Connect connection.

• A
  80% (36)
• B
  11% (5)
• C
  2% (1)
• D
  7% (3)

Explanation

Option A is correct because new VPC subnets are not automatically associated with existing route tables - each subnet needs an explicit route entry directing on-premises-bound traffic to the virtual private gateway. The existing VPN connection and virtual private gateway already span the entire VPC (not just a single AZ), so no new connection is needed; the only missing piece is a route in the new subnets' route tables pointing to that gateway.

Why the distractors are wrong:

• B is wrong because Site-to-Site VPN connections are not AZ-scoped - the virtual private gateway already serves the whole VPC, and AWS Support cannot "add AZs" to a VPN.
• C is wrong because a second VPN connection is unnecessary; the existing virtual private gateway is VPC-wide and can route traffic from any subnet once routes are configured.
• D is wrong because the underlying VPN technology is not the problem - replacing it with Direct Connect would not fix a missing route table entry.

Memory tip: Think "new subnets = new routes." Whenever you create subnets in a new AZ, they start with no knowledge of your existing routing rules. Always ask: "Does this subnet's route table know where to send traffic?" - if not, add the route manually.

No community discussion yet for this question.