ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They have peered this VPC with another VPC using a VPC Peering connection. The peered VPC has a CIDR of 10.0.0.0/16 (overlapping). The company wants to allow communication between specific instances in both VPCs without changing the CIDRs. What should they do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC
With overlapping CIDRs (both VPCs use 10.0.0.0/16), VPC Peering cannot route traffic correctly due to identical IP ranges. AWS PrivateLink (VPC endpoint services) allows instances in one VPC (service consumer) to access a service hosted in the other VPC (service provider) via private IP addresses, creating a logical connection that bypasses the routing conflict. The service is fronted by a Network Load Balancer, and consumer instances access it through a VPC endpoint. This works without modifying CIDRs. Option A is incorrect because NAT gateways are used for outbound internet access and do not resolve overlapping CIDR routing. Option C is incorrect because security group references allow traffic based on security group IDs but still rely on IP routing, which fails with overlapping CIDRs. Option D is incorrect because a Transit Gateway does not resolve overlapping CIDRs; overlapping routes would cause routing conflicts unless additional measures like NAT are used, which the question precludes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a NAT gateway in each VPC
Why it's wrong here
NAT gateways are for outbound internet, not inter-VPC routing with overlapping CIDRs.
- ✓
Use AWS PrivateLink to create a VPC endpoint service in one VPC and access it from the other VPC
Why this is correct
PrivateLink allows connectivity without IP routing, avoiding CIDR overlap issues.
- ✗
Use security group references to allow traffic between the instances
Why it's wrong here
Security groups control traffic but do not resolve routing conflicts.
- ✗
Create a Transit Gateway and attach both VPCs
Why it's wrong here
Transit Gateway cannot route between overlapping CIDRs without additional measures.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.