How to fix Transit Gateway connectivity for a new subnet in a new AZ?

ANS-C01 By islever Editorial Last updated

Short answer

B In Account B, update the transit gateway attachment. Attach the new subnet ID that is associated with us-west-2c to Account B's VPC.

Question

A company has a transit gateway in AWS Account A. The company uses AWS Resource Access Manager (AWS RAM) to share the transit gateway so that users in other accounts can connect to multiple VPCs in the same AWS Region. AWS Account B contains a VPC (10.0.0.0/16) with subnet 10.0.0.0/24 in the us-west-2a Availability Zone and subnet 10.0.1.0/24 in the us-west-2b Availability Zone. Resources in these subnets can communicate with other VPCs. A network engineer creates two new subnets: 10.0.2.0/24 in the us-west-2b Availability Zone and 10.0.3.0/24 in the us-west-2c Availability Zone. All the subnets share one route table. The default route 0.0.0.0/0 is pointing to the transit gateway. Resources in subnet 10.0.2.0/24 can communicate with other VPCs, but resources in subnet 10.0.3.0/24 cannot communicate with other VPCs. What should the network engineer do so that resources in subnet 10.0.3.0/24 can communicate with other VPCs?
  1. In Account B, add 10.0.2.0/24 and 10.0.3.0/24 as the destinations to the route table. Use the transit gateway as the target.
  2. In Account B, update the transit gateway attachment. Attach the new subnet ID that is associated with us-west-2c to Account B's VPC. Correct Answer
  3. In Account A, create a static route for 10.0.3.0/24 in the transit gateway route tables.
  4. In Account A, recreate propagation for 10.0.0.0/16 in the transit gateway route tables.

Key Takeaways

This question tests the requirement that a Transit Gateway VPC attachment must include at least one subnet in every Availability Zone where the VPC has subnets that need TGW connectivity.

When adding a new subnet in a new Availability Zone to a VPC attached to a Transit Gateway, you must update the VPC attachment to include a subnet in that AZ. Community consensus confirms that Transit Gateway attachments require at least one subnet per AZ to route traffic.

Common mistake: Many candidates choose C (adding a static route in Account A's TGW route table) because they assume the issue is routing, not attachment configuration.

Expert Analysis

Understanding Transit Gateway VPC Attachments

When a VPC is attached to a Transit Gateway (TGW), AWS requires you to specify at least one subnet per Availability Zone (AZ). This subnet is used by the TGW to route traffic to and from resources in that AZ. If you later create a new subnet in an AZ that was not originally included in the attachment, the TGW has no way to route traffic to that new subnet.

Why Option B is Correct

Option B correctly identifies that the network engineer must update the Transit Gateway VPC attachment in Account B to include the new subnet (10.0.3.0/24) in us-west-2c. As stated in the AWS documentation: "When you attach a VPC to a transit gateway, you must specify one subnet from each Availability Zone to be used by the transit gateway to route traffic." Without this update, the TGW simply does not know how to reach the new AZ.

Why the Other Options are Wrong

  • Option A is incorrect because the default route 0.0.0.0/0 already points to the TGW in the shared route table. Adding more specific routes for the subnets as destinations would not fix the underlying attachment issue.
  • Option C is a popular trap. Adding a static route in Account A's TGW route table for 10.0.3.0/24 would not help because the TGW still has no attachment association for the us-west-2c AZ. The TGW cannot route traffic to an AZ that is not part of the VPC attachment.
  • Option D is incorrect because propagation is used to automatically share routes between TGW attachments, not to add new subnets to an existing attachment. Recreating propagation for 10.0.0.0/16 would not resolve the missing AZ association.

Community Insight

As community member kajiyatta pointed out, referencing official AWS documentation, the TGW uses the specified subnets per AZ for routing. Community member Spaurito emphasized that "The new AZ is key here" — this is the core detail that distinguishes the correct answer.

Official Reference

https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question mentions a new subnet in a new Availability Zone that cannot communicate via a Transit Gateway, always check whether the VPC attachment includes a subnet in that AZ. AWS requires one subnet per AZ in the attachment for TGW routing to function.

Community Votes

B
65%
C
35%

65% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. KobDragoon 👍 6 Answered C
    If all subnets share one route table then new subnet in AZ C should also have a route to the TGW, and we don't need necessarily a TGW attachment associated with the new subnet C, it should be able to route to the existing TGW attachments inside the VPC. Only answer that makes sense to me then is C if we assume that Account B doesn't have route propagation enabled by default and the TGW route tables are using instead static routes. This would explain why traffic can't reach the new subnet but can reach the others.
  2. acloudguru 👍 6 Answered B
    Option C is incorrect because the transit gateway route tables are managed by Account A, which owns the transit gateway. Account B cannot modify the route tables in Account A's transit gateway. Option D is incorrect because propagation is not relevant in this scenario. Propagation is used when you have multiple transit gateways in different AWS Regions, and you want to propagate routes between them.
  3. Kupaloid 👍 4 Answered B
    The most likely cause is that the new subnet has not been attached to the transit gateway.
  4. kajiyatta 👍 2
    When you attach a VPC to a transit gateway, you must specify one subnet from each Availability Zone to be used by the transit gateway to route traffic. Specifying one subnet from an Availability Zone enables traffic to reach resources in every subnet in that Availability Zone. https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html
  5. hedglin 👍 1
    The correct answer is B: In Account B, update the transit gateway attachment. Attach the new subnet ID that is associated with us-west-2c to Account B's VPC. C is wrong. Creating a static route in Account A's transit gateway route tables is not necessary and wouldn't solve the issue, as the problem is with the attachment, not routing.
Show 3 more comments
  1. Spaurito 👍 1
    B - The new subnet is in a new AZ. If not associated to the TGW, then it won't communicate. The new AZ is key here.
  2. seochan 👍 1 Answered C
    There’s no such thing as ‘Attach the new subnet ID’ in TGW attachments.
  3. siheom 👍 3 Answered B
    vote B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

What is the most secure way to expose cross-account microservices with API Gateway?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide