SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The security group on the RDS database does not allow inbound traffic from the workload VPC CIDR.

  Why it's wrong here

  Security groups are stateful and can reference CIDR blocks or other security groups. If the security group does not allow inbound traffic from the workload VPC CIDR, connections would be blocked. This is a common issue, but the scenario implies that routing is set up. The question asks for the most likely cause given that routing is configured. Without more information, this is plausible, but the key detail is that the RDS database is in a private subnet and the workload accounts are in different VPCs. The most likely cause is that the route table for the subnet where the RDS database resides does not have a route back to the workload VPC CIDR via the Transit Gateway.

• ✓

  The route table associated with the subnet where the RDS database resides does not have a route back to the workload VPC CIDR via the Transit Gateway.

  Why this is correct

  For traffic to flow between VPCs through a Transit Gateway, both the source and destination subnets must have route table entries pointing to the Transit Gateway for the other VPC's CIDR. The workload VPC has a route to the shared services VPC, but the shared services VPC subnet's route table may lack a route back to the workload VPC CIDR. This asymmetric routing causes the return traffic to be dropped, preventing the connection.

• ✗

  The Transit Gateway attachment for the shared services VPC is not associated with the correct Transit Gateway route table.

  Why it's wrong here

  Transit Gateway route tables control which attachments can route to each other. If the shared services VPC attachment is not associated with a route table that has a route to the workload VPC attachment, traffic would be dropped. However, the scenario states that the workload VPC has a route to the Transit Gateway for the shared services CIDR, implying that the Transit Gateway route table likely has a route to the shared services VPC. The missing piece is often the return route in the shared services subnet route table.

• ✗

  The RDS database is not publicly accessible, and the workload resources are using public IP addresses.

  Why it's wrong here

  The RDS database is in a private subnet and should not be publicly accessible. Workload resources should use private IP addresses when communicating over a Transit Gateway. If they are using public IP addresses, the traffic would not route through the Transit Gateway. However, the scenario does not indicate that workload resources are using public IPs; it focuses on routing configuration. The most likely cause is the missing return route.

Go deeper

Related to this question