SOA-C02 Networking and Content Delivery Practice Question
A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect to an on-premises network with a CIDR of 10.0.0.0/8. What is the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CIDR blocks overlap, causing routing conflicts.
Overlapping CIDR blocks prevent VPC peering or VPN connections because routes conflict. Option A is not the issue. Option B is not the primary issue. Option D is not directly a problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The on-premises CIDR is private and cannot be used with AWS.
Why it's wrong here
Private IPv4 address ranges, including the RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), are fully supported by AWS for VPC CIDR blocks and on-premises networks. AWS does not restrict private CIDR usage; the issue with this scenario is not that the on-premises CIDR is private, but that it overlaps with the VPC CIDR, creating an unresolvable routing conflict.
- ✗
AWS does not support /8 CIDR blocks.
Why it's wrong here
AWS does support /8 CIDR blocks for VPCs, but only as part of a larger allocation scheme: the minimum VPC CIDR is /28 and the maximum is /16. So a /8 is actually too large to be assigned as a single VPC CIDR block. However, the question states the VPC is already configured with a /16 CIDR, so the /8 reference is a red herring; the real problem remains the overlapping IP ranges between the VPC and the on-premises network.
- ✓
The CIDR blocks overlap, causing routing conflicts.
Why this is correct
The VPC CIDR block 10.0.0.0/16 and an on-premises CIDR that also uses part of the 10.0.0.0/16 range overlap. When you establish a VPN connection or AWS Direct Connect between the VPC and the on-premises network, overlapping CIDRs create ambiguous routing: the VPC route table cannot determine whether traffic for those IPs should go to the local network or the on-premises network, so traffic may be dropped or misrouted. AWS does not allow overlapping CIDRs for VPC peering or for VPN/Direct Connect connections, so you must redesign the IP addressing to avoid overlap.
- ✗
The VPC CIDR is too large.
Why it's wrong here
The VPC CIDR block of 10.0.0.0/16 is perfectly valid and meets AWS's size requirements—a /16 is within the supported range of /28 to /16. AWS allows VPC CIDR blocks up to /16, and a /16 provides 65,536 IP addresses, which is ample for most environments. Therefore, the VPC CIDR being 'too large' is not the cause of the problem; the issue is the overlap with the on-premises CIDR.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 247 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.