VPC Peering Cross-Account Connectivity: Transitive Routing Limitation
A security engineer is troubleshooting connectivity issues between two VPCs connected via a VPC Peering connection. The VPCs are in different accounts. The security groups in both VPCs allow traffic between the CIDRs. The route tables have the appropriate entries. However, instances in VPC A cannot communicate with instances in VPC B. What is the most likely cause?
Quick Answer
The answer is the VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network. This is the most likely cause because VPC Peering is a non-transitive, one-to-one relationship; if traffic must pass through a third VPC, a VPN gateway, or a Direct Connect connection to reach the destination, the peering link will drop the packets even if route tables and security groups are correctly configured. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this limitation is a classic trap—candidates often overlook that VPC Peering cannot forward traffic beyond its direct pair, unlike Transit Gateway which supports transitive routing. The exam tests your ability to distinguish between stateful security groups (which automatically allow return traffic) and the inherent architectural constraint of peering. Remember the mnemonic: “Peering is a point-to-point pipe, not a hub-and-spoke highway.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network.
VPC Peering connections do not support transitive routing. If traffic must pass through an intermediate VPC or on-premises network, the peering connection alone cannot route it. Option B is incorrect because VPC Peering does not require an IAM role for cross-account communication; instead, the accepter must accept the request and route tables must be updated. Option C is incorrect because security groups are stateful and automatically allow return traffic, and the scenario states security groups allow traffic between CIDRs. Option D is incorrect because the issue is not about NACLs; if NACLs were blocking traffic, the problem would likely be related to stateless filtering, but the question focuses on security groups and routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VPC Peering connection does not support transitive routing through an intermediate VPC or on-premises network.
Why this is correct
VPC Peering is non-transitive; if there is a VPN or another VPC in the path, traffic will be dropped.
- ✗
The VPC Peering connection requires an IAM role to be assumed for cross-account communication.
Why it's wrong here
VPC Peering can work cross-account without IAM roles; only the route tables and security groups need configuration.
- ✗
The security group in VPC A does not allow inbound traffic from VPC B's CIDR.
Why it's wrong here
The security group in VPC A already allows traffic between the CIDRs per the stem, so inbound rules from VPC B’s CIDR are not the blocking factor; the issue lies in the cross-account VPC Peering requiring the VPC B owner to accept the peering request and configure the route tables in both accounts, which the stem confirms are correct. This option is tempting because security groups are a common source of connectivity failures, and in a single-account VPC Peering scenario where inbound rules are misconfigured, denying the peer CIDR would indeed prevent communication.
- ✗
The network ACL in VPC A does not allow return traffic from VPC B.
Why it's wrong here
NACLs are stateless and must allow both inbound and outbound traffic; but the issue is likely not NACLs if security groups are configured.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting connectivity between two VPCs connected via a VPC peering connection. Security groups and NACLs are configured correctly. The engineer verifies that the route tables have the necessary entries. However, traffic from an EC2 instance in VPC A to an RDS instance in VPC B fails. Which TWO additional checks should be performed? (Choose two.)
medium- ✓ A.Check that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A.
- B.Verify that the network ACLs in both VPCs have appropriate inbound and outbound rules for the traffic.
- C.Confirm that the VPCs have an Internet Gateway attached.
- D.Check that the EC2 instance has an IAM role that allows it to communicate with RDS.
- ✓ E.Ensure that the VPC peering connection is in the 'active' state.
Why A: The correct checks to perform when troubleshooting VPC peering connectivity are to ensure the VPC peering connection is in the 'active' state (Option E) and that the security group attached to the RDS instance allows inbound traffic from the CIDR block of VPC A (Option A). Without an active peer connection, traffic cannot flow even if route tables are correct. Similarly, security group rules are stateful and must explicitly permit inbound traffic; NACLs are stateless but since the issue is within the same VPC peering, security groups are a likely culprit. IAM roles and Internet Gateways are not required for VPC peering traffic.
Variation 2. A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region and the peering connection is in the 'active' state. Security groups in both VPCs allow all traffic. However, instances in VPC A cannot reach instances in VPC B. What is the most likely cause?
medium- A.Security groups are blocking traffic between the VPCs
- B.The VPC peering connection is in the 'pending-acceptance' state
- ✓ C.Route tables in one or both VPCs do not have routes pointing to the peering connection
- D.Network ACLs are blocking traffic between the VPCs
Why C: VPC peering requires route table entries in both VPCs to direct traffic to the peering connection. Option C is correct because missing routes are a common issue. Option A is wrong because security groups allow all traffic. Option B is wrong because the peering connection is active. Option D is wrong because network ACLs are not mentioned as blocking, and they are stateless but the issue is more likely routing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.