Troubleshooting AWS Cloud WAN Inter-segment Communication

Design a routing strategy and connectivity architecture between on-premises networks and the AWS Cloud.

Answer Correct answer: D — Update the core network policy to add a static route for each segment directing traffic to the specific VPC attachments.

A company has configured an AWS Cloud WAN core network with edge locations in the us-east-1 Region and the us-west-1 Region. Each edge location has two segments: development and staging. The segments use the default core network policy. The company has attached VPCs to the core network. A development VPC is attached to the development segment in us-east-1 and is configured to use the 10.0.0.0/16 CIDR block. A staging VPC is attached to the staging segment in us-west-1 and is configured to use the 10.5.0.0/16 CIDR block. The company has updated the route tables for both VPCs with a route that directs any traffic for 0.0.0.0/0 to the core network. The company’s network team needs to establish communication between the two VPCs by using the AWS Cloud WAN core network. The network team is not receiving a response during tests of communication between the VPCs. The network team has verified that security groups and network ACLs are not blocking the traffic. What should the network team do to establish this communication?

Update both VPC route tables to have a new static route. Configure a route on the development VPC to direct the traffic for 10.0.0.0/16 to the development VPC attachment. Configure a route on the staging VPC to direct the traffic for 10.5.0.0/16 to the staging VPC attachment.
Update the segment filter to allow traffic on the development and staging segments.
Set the isolate-attachments parameter to False for the development and staging segments.
Update the core network policy to add a static route for each segment. Configure a route to direct the traffic for 10.0.0.0/16 to the development VPC attachment. Configure a route to direct the traffic for 10.5.0.0/16 to the staging VPC attachment. Correct Answer

Community Insight

It tests the understanding that by default, segments are isolated; enabling traffic requires explicit static routes in the core network policy rather than VPC route table changes or segment filters.

This question addresses the default isolation behavior of AWS Cloud WAN segments and how to enable routing between them using core network policy updates.

Candidates often select Option B (updating segment filters) because they confuse attachment membership controls with traffic routing policies, or Option A due to a misunderstanding of where routing logic resides in Cloud WAN.

Community Discussion (4 comments)

elstit 👍 1 Selected: B

B. Update the segment filter to allow traffic on the development and staging segments. This option is necessary to enable inter-segment communication within the AWS Cloud WAN core network. This is important because, by default, segments may not allow communication between them unless explicitly permitted in the network policy.

gonzales 👍 1 Selected: B

Development VPC → 10.0.0.0/16 Staging VPC → 10.5.0.0/16 These routes are already known to Cloud WAN. You do not need to create static routes for them. You must modify the core network policy to share routes between the development and staging segments (via the segment filter/share action).

woorkim 👍 5 Selected: D

A. Adding static routes to VPC route tables wouldn't help because the segments themselves are isolated B. Segment filters control what attachments can join a segment, not inter-segment communication C. The isolate-attachments parameter controls isolation within a segment, not between segments D. Updating the core network policy with static routes would define how traffic should flow between segments

ArunRav 👍 8 Selected: D

You need to update the core network policy to enable communication between the VPCs.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

AWS Cloud WAN segments are isolated from each other by default to enhance security. To allow communication between attachments on different segments, you must explicitly configure routing in the Core Network Policy. By adding static routes for the specific CIDR blocks (10.0.0.0/16 and 10.5.0.0/16) pointing to their respective VPC attachments within the policy, Cloud WAN learns how to forward traffic between the isolated segments. This aligns with the principle that inter-segment traffic flow is controlled by the global policy, not local VPC settings.

Why the Other Options Are Wrong

Option A is incorrect because updating VPC route tables only affects traffic leaving or entering the VPC directly; it does not inform the Cloud WAN core network about how to route traffic between different segments. Option B is incorrect because segment filters control which attachments can join a segment (membership), not whether traffic can pass between segments (routing). Option C is incorrect because the isolate-attachments parameter applies to isolation within a single segment, preventing spoke-to-spoke communication inside that segment, whereas this scenario involves cross-segment communication.

Community Comment Notes

Community consensus strongly supports Option D. ArunRav noted that "You need to update the core network policy to enable communication," highlighting the policy's role in connectivity. Woorkim provided a detailed breakdown, stating that "Adding static routes to VPC route tables wouldn't help because the segments themselves are isolated." Another commenter emphasized that routes are already known to Cloud WAN via the attachments, so the missing link is sharing routes between segments via the core network policy.

Exam Strategy

When troubleshooting AWS Cloud WAN, always distinguish between segment membership (filters) and traffic routing (policy routes). If VPC routes are correct but traffic fails, check if the Core Network Policy explicitly allows inter-segment routing via static routes.

Frequently Asked Questions

Why don't VPC route table changes fix Cloud WAN inter-segment issues?

VPC route tables only manage local traffic entry/exit. Cloud WAN uses its own Core Network Policy to determine how to route traffic between isolated segments globally.

What is the difference between segment filters and isolate-attachments?

Segment filters control which attachments can be added to a segment (access control). Isolate-attachments prevents communication between spokes within the same segment. Neither controls cross-segment routing.

More ANS-C01 FAQ →

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide