Question

A CloudOps engineer manages three VPCs: VPC-A (10.0.0.0/16), VPC-B (10.1.0.0/16), and VPC-C (10.0.0.0/16). VPC-A is peered with VPC-B, and VPC-B is peered with VPC-C. An EC2 instance in VPC-A cannot reach an instance in VPC-C, even though route tables and security groups in both VPCs allow the traffic. What are the two underlying reasons this connectivity is failing? (The engineer must address both.)

Accepted Answer

VPC peering does not support transitive routing, and VPC-A and VPC-C have overlapping CIDR blocks which prevents a peering connection between them

Answer

Security group references across peering connections are not supported, and NACLs must be updated to allow the traffic

Answer

The peering connections are in different Regions, and inter-region peering requires a Transit Gateway instead

Answer

VPC peering requires a route to the intermediary VPC-B, and the DNS resolution option on the peering connection is disabled