AWS Networking: Handling Overlapping CIDR Blocks
A company has a VPC with a CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. The company wants to ensure that traffic to on-premises from VPC does not overlap with VPC's own CIDR. Which action should be taken?
Quick Answer
The correct action is to create a more specific route in the VPC route table for the on-premises network that falls within the 10.0.0.0/8 range but does not overlap with the VPC’s own 10.0.0.0/16 subnets. This works because AWS route tables use the most specific matching route (longest prefix match) to determine traffic direction, so a route like 10.0.0.0/8 with a more specific destination, such as 10.1.0.0/16, will direct traffic to the VPN while the VPC’s internal 10.0.0.0/16 traffic stays local. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of CIDR overlap resolution and route prioritization, a common trap being that you cannot simply change the VPC CIDR or rely on NAT to fix routing conflicts. A key memory tip is “longest prefix wins”—when overlapping CIDRs exist, the more specific route always takes precedence, allowing you to carve out non-conflicting paths for hybrid connectivity.
⚠ Common exam trap
Watch out — candidates often assume overlapping CIDRs are impossible to route and immediately choose to change the VPC CIDR (Option A), but AWS allows overlapping ranges as long as more specific routes are used to direct traffic correctly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a more specific route in the VPC route table for the on-premises network that is within the 10.0.0.0/8 range but not overlapping with the VPC's subnets.
Creating a more specific route (e.g., 10.0.0.0/8 with a longer prefix than the VPC's /16) in the VPC route table allows traffic destined for the on-premises network to be directed through the VPN, while the VPC's own /16 CIDR remains local. AWS uses the most specific route that matches the destination IP, so a route with a longer prefix (e.g., /8) will not override the local /16 route for VPC-internal traffic, preventing overlap.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the VPC CIDR to a non-overlapping range such as 172.16.0.0/16.
Why it's wrong here
VPC CIDR cannot be changed after creation; you would need to recreate the VPC.
- ✓
Create a more specific route in the VPC route table for the on-premises network that is within the 10.0.0.0/8 range but not overlapping with the VPC's subnets.
Why this is correct
More specific routes take precedence, so traffic to specific on-premises prefixes will go via VPN even if the VPC CIDR is a superset.
- ✗
Use a NAT gateway to translate the VPC's IP addresses to a different IP range when communicating with on-premises.
Why it's wrong here
NAT is for outbound internet traffic, not for resolving IP overlap in VPN connections.
- ✗
Use AWS Transit Gateway with a network overlay to encapsulate traffic.
Why it's wrong here
Transit Gateway does not provide IP overlay; it uses standard routing.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with an IPv4 CIDR of 10.0.0.0/16 and needs to connect to an on-premises network using AWS Site-to-Site VPN. The on-premises network uses 10.0.0.0/8. What should be done to avoid overlapping CIDRs?
easy- A.Configure a VPN with overlapping CIDRs, it will still work
- B.Use NAT on the customer gateway to translate addresses
- ✓ C.Create a new VPC with a non-overlapping CIDR and migrate resources
- D.Use VPC peering to connect to on-premises
Why C: AWS Site-to-Site VPN requires non-overlapping IP CIDRs between the VPC and the on-premises network for proper routing. The VPC uses 10.0.0.0/16, which falls entirely within the on-premises 10.0.0.0/8, causing a conflict that prevents the VPN from establishing routes correctly. Creating a new VPC with a non-overlapping CIDR (e.g., 172.16.0.0/16) and migrating resources resolves the overlap, enabling the VPN connection.
Variation 2. A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to a partner's VPC with CIDR 10.0.0.0/16 using a VPC peering connection. What is the issue with this configuration?
medium- A.The company has reached the maximum number of VPC peering connections
- B.VPC peering is only supported within the same region
- C.VPC peering does not support transitive routing
- ✓ D.Overlapping CIDR ranges are not supported for VPC peering
Why D: VPC peering requires that the CIDR blocks of the peered VPCs do not overlap. In this case, both VPCs use 10.0.0.0/16, which creates an identical address space. When routes are added to the route tables for the peering connection, the destination CIDR would be ambiguous, and the VPC cannot distinguish between local resources and those in the peered VPC, leading to routing conflicts. AWS explicitly rejects peering requests between VPCs with overlapping or identical CIDR ranges.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.