ANS-C01 Network Implementation Practice Question
A company has a Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to ensure that traffic always uses the Direct Connect connection when it is available, and only fails over to the VPN if Direct Connect goes down. How should they configure routing?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that BGP attributes like AS path length or weight are the primary tie-breakers, but in this scenario the longest prefix match rule overrides all BGP path attributes, making prefix specificity the correct mechanism for active/passive failover.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN.
BGP selects the most specific prefix (longest prefix match) first, regardless of other attributes. By advertising a more specific prefix (e.g., /24) over Direct Connect and a less specific prefix (e.g., /16) over VPN, traffic will always prefer the Direct Connect path when it is available. If Direct Connect fails, the more specific prefix is withdrawn, and traffic automatically falls back to the VPN using the less specific prefix.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Advertise a more specific prefix over Direct Connect and a less specific prefix over VPN.
Why this is correct
BGP always prefers the most specific prefix (longest match). This ensures Direct Connect is used when available.
- ✗
Use static routes pointing to the Direct Connect virtual interface with a lower metric than the VPN route.
Why it's wrong here
Static routes are not used with BGP; Direct Connect and VPN use BGP dynamic routing.
- ✗
Advertise the same prefix over both connections but with a lower AS path length over Direct Connect.
Why it's wrong here
BGP prefers shorter AS path only if prefix lengths are equal; here the prefixes are the same, but this would not guarantee Direct Connect preference if the AS paths are different.
- ✗
Advertise the same prefix over both connections but set a higher weight on the VPN BGP session.
Why it's wrong here
Weight is a Cisco proprietary attribute and not supported by AWS Direct Connect or VPN.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a Direct Connect connection with a private VIF to a VPC. The company also has a Site-to-Site VPN connection to the same VPC as a backup. During a failover test, traffic from on-premises to the VPC continues to use the Direct Connect even after it is intentionally failed. The BGP timers are set to default values. What is the most likely cause?
hard- A.The Direct Connect route is more specific than the VPN route.
- B.The VPN BGP route has a longer AS path than the Direct Connect route.
- C.The VPN route has a lower local preference than the Direct Connect route.
- ✓ D.The BGP session with the Direct Connect router is still established because the physical link is up, but the link is not forwarding traffic.
Why D: The Direct Connect physical link is still up, so the BGP session remains established even though the link is not forwarding traffic. With default BGP timers (keepalive 60s, hold 180s), the session does not time out, so the VPC continues to receive the Direct Connect route and prefers it over the VPN backup. A failover requires either the BGP session to go down or the route to be withdrawn, neither of which occurs when only the data plane fails.
Variation 2. A company has a Direct Connect connection with a private VIF to a VPC. They also have a site-to-site VPN as a backup. The on-premises network advertises the same prefix via BGP over both connections. The company wants to prefer the Direct Connect path. What configuration achieves this?
hard- A.Set the Multi-Exit Discriminator (MED) on the VPN advertisement to a lower value.
- B.Prepend the AS path on the Direct Connect advertisement to make it longer.
- ✓ C.Configure the Direct Connect BGP session with a higher local preference (e.g., 200) than the VPN BGP session.
- D.Configure the VPN BGP session with a higher local preference than the Direct Connect session.
Why C: Local preference is a BGP attribute used to influence outbound traffic from the local AS. By setting a higher local preference (e.g., 200) on the Direct Connect BGP session, the router will prefer that path over the VPN session (default local preference 100) for the same prefix. This ensures traffic from the VPC to on-premises uses Direct Connect as the primary path.
Variation 3. A company has an AWS Direct Connect connection with a private VIF to a VPC. They also have a VPN connection as a backup. They want to use BGP attributes to prefer the Direct Connect path. On the customer router, they set a lower local preference for routes received via the VPN. However, traffic still uses the VPN. What could be the reason?
hard- ✓ A.Local preference is not supported by AWS for BGP sessions; use AS path prepending instead
- B.The weight attribute is set higher on the VPN routes
- C.Bidirectional Forwarding Detection (BFD) is not enabled on the Direct Connect connection
- D.The BGP MED attribute is not set on the VPN routes
Why A: AWS does not honor the local preference attribute set on the customer router for routes received via the VPN. In AWS, BGP local preference is not considered; instead, AS path prepending is the standard method to influence route selection on the customer side. Option B is incorrect because weight is a Cisco-proprietary attribute that is not used in AWS BGP sessions. Option C is incorrect because BFD is used for fast failure detection, not path selection. Option D is incorrect because MED is used to influence inbound traffic from AWS, not to prefer the Direct Connect path on the customer router.
Variation 4. A company has a Direct Connect connection with a private VIF to a VPC. They also have a Site-to-Site VPN connection to the same VPC as a backup. The on-premises router is advertising the same prefixes over both connections. The company wants to ensure that traffic uses Direct Connect when available and fails over to VPN if Direct Connect goes down. Which configuration should be applied?
medium- A.Set a higher MED value on the Direct Connect BGP advertisements.
- B.Disable BGP on the VPN connection to force traffic to Direct Connect.
- ✓ C.Prepend AS path on the BGP advertisements over the VPN connection to make the path less preferred.
- D.Set a higher local preference on the VPN BGP advertisements.
Why C: To prefer Direct Connect over VPN, adjust BGP attributes on the on-premises router. Prepend AS path on the VPN BGP advertisements to increase the AS path length, making the Direct Connect path shorter and thus preferred. This ensures failover to VPN if Direct Connect fails. Option A is incorrect because setting higher MED on Direct Connect would make it less preferred, not more. Option B is incorrect because disabling BGP on VPN removes the backup connection entirely. Option D is incorrect because setting higher local preference on VPN BGP advertisements would make VPN preferred, which is the opposite of the desired behavior. Local preference is typically set on the AWS side, not on-premises.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.