VPC Peering Transitive Routing: Why Your VPN Breaks Peering
A networking engineer is troubleshooting connectivity issues between two VPCs that are peered using a VPC peering connection. The VPCs are in different AWS accounts. The engineer has verified that the route tables are correct and the security groups allow traffic. However, ICMP ping fails from an instance in VPC A to an instance in VPC B. What is a likely cause?
Quick Answer
The answer is a VPN connection attached to both VPCs creating a transitive routing issue. This is the correct choice because VPC peering explicitly does not support transitive routing—traffic must flow directly between the peered VPCs and cannot hop through an intermediate network. When both VPCs have a VPN connection to the same on-premises network, that VPN path can override the direct peering route, causing ICMP pings to fail even when route tables and security groups are correctly configured. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of VPC peering’s fundamental limitation: it is a one-to-one, non-transitive relationship. A common trap is assuming that because routes and security groups look correct, the issue must be elsewhere, but the hidden VPN route silently steals traffic. Memory tip: “Peering is direct, not a transit—VPNs can hijack the path in an instant.”
⚠ Common exam trap
AWS often tests the concept that VPC peering does not support transitive routing, and candidates may overlook how a VPN connection can inadvertently create a transitive path that breaks direct peering traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is a VPN connection attached to both VPCs that creates a transitive routing issue.
A VPN connection attached to both VPCs can introduce transitive routing, which is not supported by VPC peering. VPC peering does not allow transitive routing; traffic must flow directly between the peered VPCs. If both VPCs have a VPN connection to the same on-premises network or another network, the VPN can create a path that interferes with the direct peering path, causing ICMP pings to fail even when route tables and security groups are correctly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The route tables in both VPCs do not have the route propagation enabled.
Why it's wrong here
Route propagation is for VPN connections, not VPC peering.
- ✗
The VPC CIDR blocks overlap.
Why it's wrong here
VPC peering requires non-overlapping CIDR blocks for successful communication.
- ✓
There is a VPN connection attached to both VPCs that creates a transitive routing issue.
Why this is correct
VPC peering does not support transitive routing; if there is another connection that could create a transitive route, it may cause unexpected behavior.
- ✗
The security group in VPC A does not allow inbound ICMP from VPC B.
Why it's wrong here
Security groups are stateful; if outbound ICMP is allowed, return traffic is automatically allowed.
- ✗
The network ACLs are not configured correctly for return traffic.
Why it's wrong here
NACLs are stateless, but the engineer verified they are correct.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting connectivity between two VPCs that are peered. The route tables are correct, and security groups allow traffic. However, ICMP ping fails. What is the most likely cause?
hard- A.The route tables are not propagated
- B.VPC peering does not support ICMP
- C.The VPCs are in different regions
- ✓ D.The security groups are blocking ICMP
Why D: VPC peering does support ICMP traffic. The most common reason for ICMP ping failure despite correct route tables and security groups that allow traffic is that the security groups are not explicitly allowing ICMP. Security groups default to deny all inbound traffic, and a rule allowing all TCP traffic does not include ICMP. Therefore, the security groups must have an inbound ICMP rule for the ping to succeed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.