SAP-C02 Practice Question 32: Private Service Overlapping CIDRs
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 4 · question 2 of 10
A bank exposes an internal fraud-scoring API from a provider VPC in a shared services account. The API must be reachable from 120 consumer VPCs spread over 40 accounts. Many of those accounts arrived through acquisitions and their VPC CIDR blocks overlap with one another and, in a few cases, with the provider VPC. Re-addressing them is not an option.
The design must satisfy the security review: consumers may reach the fraud-scoring API and nothing else in the provider VPC, traffic must never traverse the public internet, and the provider must not be able to initiate connections back into consumer networks. The networking team also insists that onboarding a new consumer must not require coordinating CIDR ranges or editing route tables in either VPC.
Which design should the architect implement?
Show answer and explanation
Answer:
AWS PrivateLink privately connects a consumer VPC to a service as if the service were inside that VPC, with no internet gateway, NAT device, public IP address, Direct Connect connection, or Site-to-Site VPN involved. The consumer reaches the service through an interface endpoint whose elastic network interfaces are addressed from the consumer's own subnets, so the two VPCs' CIDR blocks are never routed to one another, which is exactly why overlapping ranges stop being a problem and why no route table has to change on either side. The endpoint exposes only the one service behind the Network Load Balancer, satisfying "the API and nothing else", and PrivateLink connections are unidirectional: the provider cannot originate traffic back through the endpoint into the consumer VPC. Onboarding a consumer becomes an endpoint creation plus an acceptance on the endpoint service.
Option B fails on the central constraint. A transit gateway is a routing device; its route tables cannot hold overlapping destination CIDRs pointing at different attachments and resolve them, so acquired VPCs with duplicate ranges cannot participate.
Option C has the same overlapping-CIDR problem, plus VPC peering does not support overlapping CIDRs by design, and 120 peering connections with route entries on both sides is precisely the per-consumer network coordination the team refused.
Option D puts a private internal API on the public internet, which the security review forbids. It also cannot work operationally: the consumers are private VPC ranges that overlap, so there are no unique source IPs to allow-list.
Reference: What is AWS PrivateLink?