VPC peering concept in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding VPC Peering Connectivity

Which statement correctly describes how two VPCs communicate when connected by a VPC peering connection?

A VPC peering allows direct routing of traffic between VPCs using private IP addresses without traversing the internet.

B Traffic between VPCs flows through the internet gateway of each VPC.

C VPC peering requires a VPN connection to enable communication between VPCs.

D VPC peering automatically shares all resources like security groups and route tables between VPCs.

💡 Hint

Think about how private networks connect without using the public internet.

VPC peering enables direct network routing between VPCs using private IPs, without using the internet or VPNs. It does not share resources automatically.

❓ Architecture

intermediate

VPC Peering Route Table Configuration

You have two VPCs peered: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). To enable instances in VPC-A to reach instances in VPC-B, what must you do?

A Add a route in VPC-A's route table pointing 10.1.0.0/16 to the NAT gateway.

B Add a route in VPC-B's route table pointing 10.0.0.0/16 to the internet gateway.

C Add a route in VPC-A's route table pointing 10.1.0.0/16 to the VPC peering connection.

D No route changes are needed; peering automatically updates route tables.

💡 Hint

Think about how traffic knows where to go inside a network.

To route traffic to the peered VPC, you must add a route in the source VPC's route table pointing the destination CIDR to the peering connection.

❓ security

advanced

Security Group Behavior with VPC Peering

After establishing a VPC peering connection, which security group rule is required to allow inbound traffic from the peered VPC?

A No security group changes are needed because peering bypasses security groups.

B Allow inbound traffic only from the internet gateway IP in the security group.

C Allow inbound traffic from 0.0.0.0/0 in the security group of the receiving instance.

D Allow inbound traffic from the peered VPC's CIDR block in the security group of the receiving instance.

💡 Hint

Consider how security groups filter traffic based on IP ranges.

Security groups must explicitly allow inbound traffic from the IP range of the peered VPC to permit communication.

❓ service_behavior

advanced

Limitations of VPC Peering Connections

Which of the following is a true limitation of AWS VPC peering connections?

A VPC peering connections do not support transitive routing between peered VPCs.

B VPC peering connections allow automatic DNS resolution between VPCs without configuration.

C VPC peering connections can be created between any number of VPCs without limits.

D VPC peering connections automatically replicate security group rules across VPCs.

💡 Hint

Think about how traffic flows through multiple peered VPCs.

VPC peering does not support transitive routing; traffic cannot pass through one peered VPC to reach another.

✅ Best Practice

expert

Designing Scalable VPC Peering Architecture

You have 5 VPCs that need to communicate with each other. What is the best approach to minimize complexity and maintain security?

A Use internet gateways in each VPC and communicate over the public internet.

B Use a central VPC as a hub and peer all other VPCs to it (hub-and-spoke).

C Connect all VPCs through a VPN gateway in one VPC.

D Create peering connections between every pair of VPCs (full mesh).

💡 Hint

Consider how to reduce the number of connections while keeping control.

Hub-and-spoke reduces the number of peering connections and centralizes control, improving scalability and security.

Practice

1. What is the main purpose of VPC peering in AWS?

easy

A. To connect two private networks securely within AWS

B. To provide public internet access to a VPC

C. To create a backup of a VPC in another region

D. To launch virtual machines automatically

Solution

1. Step 1: Understand VPC peering concept

   VPC peering connects two private networks (VPCs) securely inside AWS without using the public internet.

2. Step 2: Compare options

   Only To connect two private networks securely within AWS describes secure connection of private networks. Other options describe unrelated AWS features.

3. Final Answer:

   To connect two private networks securely within AWS -> Option A

4. Quick Check:

   VPC peering = secure private network connection [OK]

Hint: VPC peering links private networks, not public access [OK]

Common Mistakes:

• Confusing VPC peering with internet gateway
• Thinking VPC peering creates backups
• Assuming it launches virtual machines

2. Which of the following is the correct way to create a VPC peering connection using AWS CLI?

easy

A. aws ec2 create-route-table --vpc-id vpc-123abc

B. aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def

C. aws ec2 create-subnet --vpc-id vpc-123abc --cidr-block 10.0.0.0/24

D. aws ec2 create-internet-gateway --vpc-id vpc-123abc

Solution

1. Step 1: Identify the correct AWS CLI command for VPC peering

   The command to create a VPC peering connection is create-vpc-peering-connection with source and peer VPC IDs.

2. Step 2: Check options

   aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def uses the correct command and parameters. Other options create unrelated resources like internet gateway, subnet, or route table.

3. Final Answer:

   aws ec2 create-vpc-peering-connection --vpc-id vpc-123abc --peer-vpc-id vpc-456def -> Option B

4. Quick Check:

   VPC peering CLI = create-vpc-peering-connection [OK]

Hint: Look for 'create-vpc-peering-connection' command [OK]

Common Mistakes:

• Using internet gateway or subnet commands instead
• Confusing route table creation with peering
• Missing peer VPC ID parameter

3. After establishing a VPC peering connection between VPC A and VPC B, which step is necessary to enable communication between instances in both VPCs?

medium

A. Attach a NAT gateway to both VPCs

B. Create an internet gateway in both VPCs

C. Enable public IP addresses on all instances

D. Update route tables in both VPCs to include routes to each other's CIDR blocks

Solution

1. Step 1: Understand VPC peering communication requirements

   VPC peering connects networks but does not automatically update routing. You must add routes to route tables for traffic to flow.

2. Step 2: Analyze options

   Only Update route tables in both VPCs to include routes to each other's CIDR blocks correctly describes updating route tables with routes to the peer VPC's CIDR block. Other options relate to internet or NAT, not peering.

3. Final Answer:

   Update route tables in both VPCs to include routes to each other's CIDR blocks -> Option D

4. Quick Check:

   Route tables must include peer CIDR for communication [OK]

Hint: Always update route tables after peering [OK]

Common Mistakes:

• Assuming internet gateway is needed for peering
• Thinking public IPs are required
• Confusing NAT gateway with peering setup

4. You created a VPC peering connection but instances in VPC A cannot reach instances in VPC B. What is the most likely cause?

medium

A. Instances need public IP addresses to communicate over peering

B. The VPC peering connection is automatically rejected after creation

C. Route tables in VPC A or VPC B do not have routes to the peer VPC's CIDR block

D. Security groups do not allow internet traffic

Solution

1. Step 1: Check common VPC peering issues

   Communication fails often because route tables lack routes to the peer VPC's CIDR block.

2. Step 2: Evaluate other options

   The VPC peering connection is automatically rejected after creation is false; peering is not auto-rejected. Instances need public IP addresses to communicate over peering is wrong; public IPs are not needed. Security groups do not allow internet traffic is unrelated to peering communication.

3. Final Answer:

   Route tables in VPC A or VPC B do not have routes to the peer VPC's CIDR block -> Option C

4. Quick Check:

   Missing routes cause peering communication failure [OK]

Hint: Check route tables first when peering fails [OK]

Common Mistakes:

• Assuming peering rejects automatically
• Thinking public IPs are required for peering
• Confusing security group rules with internet traffic

5. You have two VPCs in different AWS regions and want to connect them using VPC peering. What is the correct approach?

hard

A. Create an inter-region VPC peering connection and update route tables accordingly

B. Create a standard VPC peering connection; region does not matter

C. Use an internet gateway to connect the two VPCs

D. Launch VPN instances in both VPCs and connect them manually

Solution

1. Step 1: Understand VPC peering across regions

   A special inter-region VPC peering connection is required to connect VPCs in different AWS regions.

2. Step 2: Analyze options

   Create an inter-region VPC peering connection and update route tables accordingly correctly states creating an inter-region peering and updating routes. Create a standard VPC peering connection; region does not matter is wrong because standard peering is regional. Use an internet gateway to connect the two VPCs and D describe unrelated or complex alternatives.

3. Final Answer:

   Create an inter-region VPC peering connection and update route tables accordingly -> Option A

4. Quick Check:

   Inter-region peering requires special connection and routing [OK]

Hint: Use inter-region peering for different AWS regions [OK]

Common Mistakes:

• Trying standard peering across regions
• Using internet gateway for private VPC connection
• Ignoring route table updates after peering