Branches reach an AWS cloud gateway. The application VPC is peered to the gateway VPC and is not attached itself. Its route table sends the campus prefixes to an internet gateway. What should that route table use?
Select an answer to reveal the explanation.
Short Explanation
The application VPC can see its neighbor and is sending your campus prefixes out to the internet. You point that route table back across the peering to the cloud gateway. A peered VPC does not have to be a dead end, and a SIG tunnel is not this return path.
Full Explanation
Instances in the application VPC follow their route table. This table sends the campus prefixes to an internet gateway, so return traffic never crosses the peering to the cloud gateway the branches are using. Point those prefixes across the peering toward the gateway. Leaving them on the internet gateway is why the sessions fail. A SIG tunnel is for inspected internet traffic. It does not carry the private campus prefixes for this peered VPC. VPN 512 is not a route target the VPC uses. Exam caveat: the peering itself has to allow the campus prefix. A route table aimed at the peer still fails if the peering connection does not import that prefix. Operational check: the application VPC route for the campus prefix should point at the peering, and a branch host should get an answer from an instance there.