ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a Direct Connect connection to AWS with a private VIF to a VPC. They also have a VPN connection as a backup. The BGP sessions are established. They want to ensure that traffic from on-premises to the VPC prefers the Direct Connect path over the VPN. The on-premises router is advertising the same prefix to both connections. What should the network engineer configure on the AWS side?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the on-premises router to prepend AS path for routes advertised over the VPN connection.
To prefer the Direct Connect path over the VPN for traffic from on-premises to the VPC, the on-premises router should prepend its AS number multiple times for the routes advertised over the VPN connection. This increases the AS path length, making the Direct Connect path more preferred. AWS does not allow manipulation of BGP attributes on the customer side of the Direct Connect or VPN connections, so the change must be made on the on-premises router. Option A is incorrect because local preference is a Cisco-specific feature and affects outbound traffic, not inbound. Option B is incorrect because VPC route tables only apply to traffic inside the VPC, not to BGP path selection. Option C is incorrect because MED is typically used to influence outbound traffic from AWS to on-premises and is not as effective as AS path prepending for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set a higher local preference value on the on-premises router for the Direct Connect route.
Why it's wrong here
Wrong: Local preference is a Cisco concept, not applicable to AWS.
- ✗
Update the VPC route table to give higher priority to the Direct Connect route.
Why it's wrong here
Wrong: VPC route tables do not affect BGP path selection.
- ✗
Set a lower MED value on the Direct Connect virtual interface.
Why it's wrong here
Wrong: MED is not typically used for this scenario.
- ✓
Configure the on-premises router to prepend AS path for routes advertised over the VPN connection.
Why this is correct
Correct: AS path prepending makes VPN path less preferred.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.