A campus IOS XE router learns a default route from its internet edge and, by redistribution, advertises that default to an AWS virtual private gateway by BGP. VPC instances then try to use the campus for their internet path and fail. What should the router stop advertising?
Select an answer to reveal the explanation.
Short Explanation
You mailed AWS a map that says the whole internet lives on your campus, and their instances believed you. You filter that default outbound on the BGP session. AWS should learn the campus prefixes it needs, not a default that drags VPC internet traffic into a path that fails.
Full Explanation
Redistributing the internet default into the BGP session teaches the virtual private gateway that the campus is the next hop for every unknown destination. VPC instances then follow that default toward the campus and fail if the campus was not built to be their internet exit. An outbound prefix filter, or a route map, that denies 0.0.0.0/0 toward AWS stops the bad advertisement and leaves the specific campus prefixes in place. Stopping every campus prefix removes the site-to-site routes the VPN exists to provide. The default is the prefix to deny, not the whole table. The IKE identity is unrelated. BGP is already established, so authentication succeeded, and a default route is not an authentication object. The session in use is BGP to the virtual private gateway, not OSPF. That gateway does not take an OSPF default. Exam caveat: if the design truly intends the campus to be the VPC's internet exit, the default is deliberate and the campus must be able to forward and return that traffic. This failure says the instances fail, so the accidental default should be removed. Operational check: show ip bgp neighbors advertised-routes toward AWS should list the campus prefixes and not 0.0.0.0/0.