How to Add IP Address Space to an Existing VPC Availability Zone with CloudFormation?

A company ran out of IP address space in one of the Availability Zones in an AWS Region that the company uses. The Availability Zone that is out of space is assigned the 10.10.1.0/24 CIDR block. The company manages its networking configurations in an AWS CloudFormation stack. The company’ VPC is assigned the 10 10.0.0/16 CIDR block and has available capacity in the 10.10.1.0/22 CIDR block. How should a network specialist add more IP address space in the existing VPC with the LEAST operational overhead?

  1. Update the AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Change the CidrBlock property to 10.10.1.0/22.
  2. Update the AWS::EC2::VPC resource in the CloudFormation stack. Change the CidrBlock property to 10.10.1.0/22.
  3. Copy the CloudFormation stack. Set the AWS::EC2::VPC resource CidrBlock property to 10.10.0.0/16. Set the AWS::EC2::Subnet resource CidrBlock property to 10.10.1.0/22 for the Availability Zone.
  4. Create a new AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Set the CidrBlock property to 10.10.2.0/24. Source Reference Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests whether you know that VPC subnets cannot be resized after creation and that the VPC already contains the needed free address space—so the correct action is to add a new subnet, not modify the VPC or existing subnet.

The least-overhead way to add IP space in an existing VPC for a specific Availability Zone is to create a new subnet in that AZ with a non-overlapping CIDR block, such as 10.10.2.0/24. AWS subnets are immutable, so updating or resizing an existing subnet is not the correct solution.

A common mistake is choosing option A, which tries to update the existing subnet's CidrBlock to a larger /22 range. Candidates pick this because it seems like a direct way to expand available IPs, but AWS does not allow changing the CIDR of an existing subnet; any change would replace the subnet and interrupt running resources.

Community Discussion (7 comments)

Cacheirez 👍 6 Selected: D
By creating a new subnet with a different CIDR block (10.10.2.0/24) within the same Availability Zone, you can expand the IP address space available for that AZ without altering existing configurations. This approach is straightforward and minimizes the risk of disruption to the existing resources. This option allows you to quickly and easily increase the available IP space without needing to modify or replace existing subnets, which could cause service disruptions or require reassigning resources within the AZ. It avoids the complexities and potential issues associated with resizing subnets or VPCs, which can be more involved and risky. Changing the CIDR block of an existing subnet is not supported directly because subnets cannot be resized or modified after creation. Doing so would require deleting and recreating the subnet, which would disrupt any resources tied to it.
AzureDP900 👍 1 Selected: D
To add more IP address space in the existing VPC with the LEAST operational overhead, I would recommend: • D. Create a new AWS::EC2::Subnet resource for the Availability Zone in the CloudFormation stack. Set the CidrBlock property to 10.10.1.0/24. This option has minimal operational overhead because it doesn't require any changes to existing infrastructure or resources within the VPC. It simply creates a new subnet with a larger CIDR block, which can be used to provide additional IP addresses.
Spaurito 👍 1
D - This meets the requirements and is the solution. The others would not work and CF will rebuild the subnet if provisioned.
VerRi 👍 1 Selected: D
A. Cannot update CIDR of the existing subnet B. Cannot update CIDR of the existing subnet C. Not recommended for IP Reassignment
qomtodie 👍 2 Selected: D
This is D
cas_tori 👍 1 Selected: D
this is D
aragon_saa 👍 1 Selected: A
Answer is A

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Understanding the Scenario

The company has a VPC with a CIDR of 10.10.0.0/16, which contains plenty of unused IP addresses. However, one specific Availability Zone is running out of IP space because its existing subnet is only 10.10.1.0/24. The goal is to add more usable IP addresses in that same AZ with minimal disruption.

Why Option D Is Correct

Option D — Create a new AWS::EC2::Subnet resource for the Availability Zone and set CidrBlock to 10.10.2.0/24 — is the cleanest solution. This new subnet is inside the VPC's /16 range, does not overlap with the existing 10.10.1.0/24 subnet, and adds 256 more usable addresses. It also requires no changes to existing resources, so operational overhead is minimal.

Why the Other Options Fail

  • Option A would change the existing subnet's CIDR to 10.10.1.0/22. AWS does not support modifying the CIDR block of an existing subnet. A CloudFormation update would delete and recreate the subnet, which would disrupt any resources inside it.
  • Option B would change the VPC's CidrBlock to 10.10.1.0/22. A VPC's primary CIDR block cannot be altered after creation. Also, 10.10.1.0/22 is a subset of the existing 10.10.0.0/16, so this would actually shrink the VPC, not expand it.
  • Option C copies the entire stack and sets the VPC CIDR to 10.10.0.0/16 while attempting to change the subnet to 10.10.1.0/22. This still requires replacing the subnet, recreating all dependent resources, and duplicates the stack — adding significant overhead and risk.

Community Consensus

Community discussion strongly favors D. One commenter, Cacheirez, noted that creating a new subnet with a different CIDR in the same AZ expands IP space without altering existing configurations. Another, VerRi, correctly pointed out that options A and B are invalid because you cannot update the CIDR of an existing subnet or an existing VPC. The vote distribution (D: 92) reflects that this is the intended answer.

Key Takeaway

Always check whether the VPC has free address space. If it does, the simplest way to add capacity for an AZ is to add a new subnet in that AZ with a unique CIDR. Never try to modify an existing subnet's CIDR because the resource is immutable.

Official Reference

Exam Strategy

When a question asks for the "least operational overhead," it often points to adding resources rather than changing them. Remember that AWS CloudFormation replaces immutable resources when their properties like CidrBlock change, so creating a new subnet is the safe, low-risk choice.

Related Analysis

A network engineer needs to improve the network security of

S-Grade

A company deployed an application in two AWS Regions in one

S-Grade

A company securely connects resources that are in its VPC to

S-Grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide