Route tables configuration in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the correct route table entry for internet access

You have a VPC with CIDR 10.0.0.0/16 and a subnet 10.0.1.0/24. You want instances in this subnet to access the internet. Which route table entry correctly enables this?

A Destination: 0.0.0.0/0, Target: eni-12345678

B Destination: 0.0.0.0/0, Target: igw-12345678

C Destination: 10.0.0.0/16, Target: nat-12345678

D Destination: 10.0.1.0/24, Target: local

💡 Hint

Internet access requires routing all external traffic (0.0.0.0/0) to the internet gateway.

To allow internet access, the route table must send all traffic destined outside the VPC (0.0.0.0/0) to the internet gateway (igw). Other options either route internal traffic or use incorrect targets.

❓ Architecture

intermediate

Choosing route tables for public and private subnets

You have a VPC with public and private subnets. Which route table setup correctly isolates private subnet traffic from direct internet access?

A Public subnet route table: 0.0.0.0/0 → igw; Private subnet route table: 0.0.0.0/0 → nat-gateway

B Public subnet route table: 0.0.0.0/0 → local; Private subnet route table: 0.0.0.0/0 → local

C Both subnets use the same route table with 0.0.0.0/0 → igw

D Public subnet route table: 0.0.0.0/0 → nat-gateway; Private subnet route table: 0.0.0.0/0 → igw

💡 Hint

Private subnets use NAT gateways to access the internet indirectly.

Public subnets route internet traffic directly to the internet gateway. Private subnets route internet traffic to a NAT gateway, which allows outbound internet access without exposing instances directly.

❓ security

advanced

Effect of missing local route in route table

What happens if a route table in a VPC does not include the default local route (e.g., 10.0.0.0/16 → local)?

A No effect; local route is optional.

B Instances lose internet access but can communicate internally.

C Instances can communicate internally but cannot reach the internet.

D Instances cannot communicate with each other within the VPC subnet range.

💡 Hint

The local route enables communication inside the VPC CIDR block.

The local route is automatically added to route tables and allows instances to communicate within the VPC. Removing it breaks internal communication between instances.

❓ service_behavior

advanced

Route table behavior with overlapping CIDR blocks

You have a route table that includes the routes 10.0.0.0/16 → local and 10.0.1.0/24 → nat-gateway. Which route applies for traffic to 10.0.1.5?

A Traffic routes to the NAT gateway because 10.0.1.0/24 is more specific.

B Traffic routes locally because 10.0.0.0/16 covers the entire range.

C Traffic is dropped due to conflicting routes.

D Traffic routes randomly to either local or NAT gateway.

💡 Hint

More specific routes take priority over broader ones.

Route tables prioritize the most specific route. Since 10.0.1.0/24 is more specific than 10.0.0.0/16, traffic to 10.0.1.5 goes to the NAT gateway.

🧠 Conceptual

expert

Diagnosing route table misconfiguration causing subnet isolation

A subnet's instances cannot reach the internet, but the subnet is public and associated with a route table that has 0.0.0.0/0 → igw. What is the most likely cause?

A The subnet's network ACL blocks outbound internet traffic.

B The internet gateway is not attached to the VPC.

C The subnet's instances lack public IP addresses.

D The route table is missing the local route for the VPC CIDR.

💡 Hint

Public subnets require instances to have public IPs to access the internet.

Even with correct routing, instances in a public subnet need public IP addresses to communicate with the internet. Without them, traffic cannot flow out.

Practice

1. What is the main purpose of a route table in AWS networking?

easy

A. To manage user permissions

B. To store user data securely

C. To direct network traffic between subnets and gateways

D. To monitor server health

Solution

1. Step 1: Understand the role of route tables

   Route tables control how network traffic moves inside a cloud network by defining paths.

2. Step 2: Identify what route tables connect

   They connect subnets to gateways or other networks, enabling communication.

3. Final Answer:

   To direct network traffic between subnets and gateways -> Option C

4. Quick Check:

   Route tables = traffic direction [OK]

Hint: Route tables guide traffic flow inside the cloud [OK]

Common Mistakes:

• Confusing route tables with security groups
• Thinking route tables store data
• Mixing route tables with monitoring tools

2. Which of the following is the correct way to associate a route table with a subnet in AWS CLI?

easy

A. aws ec2 create-route-table --subnet-id subnet-12345 --route-table-id rtb-67890

B. aws ec2 associate-route-table --subnet-id subnet-12345 --route-table-id rtb-67890

C. aws ec2 attach-route-table --subnet subnet-12345 --table rtb-67890

D. aws ec2 link-route-table --subnet subnet-12345 --route-table rtb-67890

Solution

1. Step 1: Identify the correct AWS CLI command for association

   The command to associate a route table with a subnet is 'associate-route-table'.

2. Step 2: Check the correct syntax and parameters

   The correct syntax uses '--subnet-id' and '--route-table-id' flags with IDs.

3. Final Answer:

   aws ec2 associate-route-table --subnet-id subnet-12345 --route-table-id rtb-67890 -> Option B

4. Quick Check:

   Associate route table = associate-route-table command [OK]

Hint: Use 'associate-route-table' with subnet and route table IDs [OK]

Common Mistakes:

• Using 'create-route-table' instead of 'associate-route-table'
• Wrong parameter names like '--subnet' instead of '--subnet-id'
• Using non-existent commands like 'attach-route-table'

3. Given a route table with the following routes:
Destination: 0.0.0.0/0, Target: igw-12345
Destination: 10.0.1.0/24, Target: local
What happens when an instance in subnet 10.0.1.0/24 tries to reach 8.8.8.8?

medium

A. Traffic is sent to the internet gateway (igw-12345)

B. Traffic is blocked because no route exists

C. Traffic is sent to the local subnet only

D. Traffic is sent to a NAT gateway automatically

Solution

1. Step 1: Analyze the route for 0.0.0.0/0

   This route sends all traffic not matching other routes to the internet gateway (igw-12345).

2. Step 2: Determine route for 8.8.8.8

   Since 8.8.8.8 is outside the local subnet, it matches the 0.0.0.0/0 route and goes to the internet gateway.

3. Final Answer:

   Traffic is sent to the internet gateway (igw-12345) -> Option A

4. Quick Check:

   Default route sends traffic to internet gateway [OK]

Hint: Default 0.0.0.0/0 route sends traffic outside subnet [OK]

Common Mistakes:

• Assuming traffic is blocked without explicit deny
• Confusing local route with internet access
• Thinking NAT gateway is used without configuration

4. You created a route table and associated it with a subnet, but instances in that subnet cannot access the internet. What is the most likely mistake?

medium

A. The route table lacks a route to an internet gateway

B. The subnet is not associated with any route table

C. The route table has a route to a NAT gateway instead of an internet gateway

D. The instances have no security group attached

Solution

1. Step 1: Check route table routes for internet access

   Internet access requires a route to an internet gateway (igw) for 0.0.0.0/0.

2. Step 2: Identify missing or incorrect routes

   If the route to the internet gateway is missing, instances cannot reach the internet despite association.

3. Final Answer:

   The route table lacks a route to an internet gateway -> Option A

4. Quick Check:

   Internet needs 0.0.0.0/0 route to igw [OK]

Hint: Check for 0.0.0.0/0 route to internet gateway [OK]

Common Mistakes:

• Assuming subnet association alone grants internet access
• Confusing NAT gateway with internet gateway routes
• Ignoring security group rules as cause

5. You have two subnets: Subnet A (10.0.1.0/24) and Subnet B (10.0.2.0/24). You want instances in Subnet A to access the internet via a NAT gateway in Subnet B, but Subnet B should not have direct internet access. How should you configure the route tables?

hard

A. Associate Subnet A's route table with 0.0.0.0/0 to the NAT gateway; Subnet B's route table with no route to internet gateway

B. Associate Subnet A's route table with 0.0.0.0/0 to the internet gateway; Subnet B's route table with 0.0.0.0/0 to the NAT gateway

C. Associate both subnets' route tables with 0.0.0.0/0 to the internet gateway

D. Associate Subnet A's route table with a route 0.0.0.0/0 to the NAT gateway; Subnet B's route table with 0.0.0.0/0 to the internet gateway

Solution

1. Step 1: Understand NAT gateway purpose

   NAT gateway allows instances in private subnet (Subnet A) to access internet outbound.

2. Step 2: Configure Subnet B's route table (NAT subnet)

   Subnet B must have 0.0.0.0/0 to internet gateway so NAT can reach internet. Direct access for instances in B can be restricted via security groups.

3. Step 3: Configure Subnet A's route table

   Subnet A has 0.0.0.0/0 to NAT gateway.

4. Final Answer:

   Associate Subnet A's route table with a route 0.0.0.0/0 to the NAT gateway; Subnet B's route table with 0.0.0.0/0 to the internet gateway -> Option D

5. Quick Check:

   Private to NAT; NAT subnet to igw [OK]

Hint: Private subnet (A) routes to NAT; NAT subnet (B) routes to igw [OK]

Common Mistakes:

• Omitting igw route in NAT subnet (B), breaking NAT functionality
• Routing private subnet (A) directly to igw
• Confusing NAT gateway and internet gateway roles