ANS-C01 Network Management and Operations Practice Question

Correct answer & explanation

The exhibit shows that the route filter prefixes for the private VIF include only '10.0.0.0/16'. This means that only this prefix is allowed to be advertised from AWS to on-premises. If the VPC has subnets that are not part of the 10.0.0.0/16 block (e.g., if the VPC has additional CIDRs), they will not be advertised. However, the VPC CIDR is 10.0.0.0/16, so all subnets should be within that. Another possibility: the on-premises router might be filtering routes. But the most likely cause from the exhibit is that the route filter prefixes are missing the specific subnet prefixes if the VPC uses multiple CIDRs. But the VPC CIDR is a single /16, so the route filter should cover all. Wait, the issue is that some subnets are not reachable. Perhaps the VPC has multiple CIDRs, or the route filter is too restrictive. The exhibit shows only one prefix. If the VPC has additional CIDRs (e.g., 10.1.0.0/16), they would not be advertised. But the question says VPC CIDR is 10.0.0.0/16. So maybe the issue is that the on-premises router is not receiving the specific subnet routes because AWS sends only the VPC CIDR by default. That should be sufficient. If the on-premises network has routes to the VPC, it should reach all subnets. Another common issue: the route filter prefixes on the private VIF are used to allow prefixes from on-premises, not to control what AWS advertises. Actually, the routeFilterPrefixes attribute on a private VIF defines the prefixes that the customer will advertise to AWS. It does not control what AWS advertises to the customer. AWS advertises the VPC CIDR automatically. So the exhibit shows the customer's allowed prefixes. That might not be the issue. The question might be misinterpreting. Possibly the issue is that the VIF's route filter is empty or missing, but it has one. I think the intended answer is that the route filter prefixes are not configured to allow the specific subnet prefixes from on-premises. But the question is about reaching subnets in the VPC. Let's re-read: 'on-premises network cannot reach some subnets in the VPC'. That could be because the on-premises router does not have routes to those subnets. AWS advertises the VPC CIDR, so the on-premises router should have a route to the whole /16. If it can reach some subnets but not others, it might be due to security groups or network ACLs. However, the exhibit shows the BGP session is up and traffic is flowing. The most likely cause based on the exhibit is that the route filter prefixes are too restrictive for the on-premises advertised routes, but that affects traffic from VPC to on-premises? No. I think the correct answer is that the VPC has multiple CIDRs and the route filter only allows the main CIDR, but the question says VPC CIDR is 10.0.0.0/16. I'll go with the option that the VPC has additional CIDRs beyond /16. But I need to craft options. Let's provide plausible options.

Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.