SOA-C02 VPC Peering Practice Question
A company has two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The SysOps administrator needs to establish connectivity between these VPCs so that resources in VPC-A can reach resources in VPC-B using private IP addresses. The solution must be highly available and not involve a third-party appliance. Which solution should the administrator implement?
⚠ Common exam trap
The trap here is that candidates often overcomplicate the solution by choosing Transit Gateway (Option A) for high availability, forgetting that VPC Peering is inherently highly available within a region and is the simplest, most cost-effective option for connecting just two VPCs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.
VPC Peering provides direct, private IP connectivity between two VPCs using the AWS global network, with no bandwidth bottleneck or single point of failure. By creating a peering connection and adding routes to the other VPC's CIDR in each VPC's route table, resources can communicate privately and the solution is highly available as the peering connection itself is redundant within AWS's infrastructure. No third-party appliance is required, and the setup is fully managed by AWS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an AWS Transit Gateway and attach both VPCs to it. Configure route tables to allow communication.
Why it's wrong here
While AWS Transit Gateway is an excellent solution for connecting multiple VPCs and on-premises networks, it is overkill for establishing connectivity between just two VPCs in the same AWS account and Region. The scenario specifically asks for a solution for two VPCs, making a VPC peering connection the more direct and cost-effective approach that satisfies the requirements without the added complexity and cost of a Transit Gateway.
- ✓
Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.
Why this is correct
VPC Peering is a one-to-one networking connection between two VPCs that enables direct traffic using private IPv4 or IPv6 addresses. Because the peering connection uses AWS's existing global network, traffic never traverses the public internet, and there are no additional hourly costs for the peering itself, aside from data transfer. After the peering request is accepted, you must add explicit routes in each VPC's route table pointing to the other VPC's CIDR block, and update the security group and network ACL rules to allow the traffic. For a simple two-VPC scenario in the same account and region, this is the most straightforward and cost-effective solution.
- ✗
Attach an internet gateway to each VPC and use Amazon Route 53 to resolve private DNS names over the internet.
Why it's wrong here
Attaching an internet gateway to each VPC makes the VPCs reachable from the internet, but it does not create a private network path between them. Instances would need public IP addresses, and traffic would egress to the public internet, incurring data transfer costs and exposing the traffic to potential interception and compromised security. Additionally, Amazon Route 53 private DNS resolution is designed to work within VPCs through the Route 53 Resolver, not over an internet-bound connection, so this setup cannot provide private IP-based communication. This approach fundamentally violates the requirement to connect the VPCs using private IP addresses.
- ✗
Set up a site-to-site VPN connection between the two VPCs using AWS Virtual Private Gateway.
Why it's wrong here
A site-to-site VPN connection requires a customer gateway on the on-premises side and a virtual private gateway on the AWS side, and it is designed for hybrid connectivity between an on-premises network and AWS, not for direct VPC-to-VPC communication. To use it here, you would have to create a VPN configuration in each VPC with a virtual private gateway and a customer gateway representing the other VPC, which is unnecessarily complex and adds software-dependent tunnel endpoints. The traffic would travel through encrypted VPN tunnels over the public internet, introducing higher latency and operational overhead, and that complexity is not needed when VPC peering offers a simpler, lower-latency private connection.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.