ANS-C01 Network Implementation Practice Question
A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network team notices that traffic to a particular EC2 instance is taking a suboptimal path that goes through the internet instead of Direct Connect. The EC2 instance has both a private IP and a public IP. The on-premises router is advertising the VPC's CIDR block over BGP. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on BGP routing issues (like option C) or security group misconfigurations (option B), but the real cause is a DNS resolution problem that diverts traffic to the public IP, bypassing the Direct Connect path entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address.
The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address. When the on-premises router advertises the VPC CIDR over BGP, traffic destined for the VPC should use Direct Connect. However, if DNS returns the public IP, the on-premises hosts will send traffic to the internet (via the public IP) rather than through the private VIF, causing a suboptimal path. This is a common misconfiguration where DNS resolution does not account for private connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The private VIF is not configured to route the VPC CIDR.
Why it's wrong here
The private VIF can route the VPC CIDR if advertised; the issue is that the on-premises device is using the public IP.
- ✗
The security group on the EC2 instance is blocking traffic from the on-premises IP range.
Why it's wrong here
Security groups control traffic at the instance level, but do not affect which path traffic takes.
- ✗
The on-premises router is not advertising the VPC CIDR to the Direct Connect router.
Why it's wrong here
The scenario states the on-premises router is advertising the VPC CIDR, so this is not the issue.
- ✓
The on-premises DNS is resolving the EC2 instance's public IP address instead of its private IP address.
Why this is correct
When using Direct Connect, you should use private IP addresses to ensure traffic stays on the private network.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.