ANS-C01 Network Implementation Practice Question
A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They have also set up a Site-to-Site VPN as a backup. The VPC has a virtual private gateway (VGW) attached. The on-premises network uses BGP over the Direct Connect and static routes for the VPN. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect when it is available; instead, it goes over the VPN. The VPC route table has a route for the on-premises CIDR (10.0.0.0/8) to the VGW. The VPN connection is configured with static routes. What is the MOST likely cause of this behavior?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPN static route has higher precedence than the BGP route from Direct Connect
When a VPC route table has a route for the on-premises CIDR (10.0.0.0/8) pointing to the VGW, AWS uses the longest prefix match to select the route. If both the Direct Connect BGP route and the VPN static route have the same prefix length, static routes are preferred over propagated BGP routes. Therefore, the VPN static route takes precedence, causing traffic to flow over the VPN even when Direct Connect is available. To fix this, the VPN should use BGP instead of static routes, or the static route should be removed so that the BGP route from Direct Connect is used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VPN static route has higher precedence than the BGP route from Direct Connect
Why this is correct
Correct; static routes (from VPN) are preferred over BGP propagated routes in AWS route tables.
- ✗
The VPC route table does not have a route for the on-premises CIDR
Why it's wrong here
Incorrect; it does have a route.
- ✗
The VGW is not attached to the VPC
Why it's wrong here
Incorrect; the VGW is attached.
- ✗
The Direct Connect virtual interface is not associated with the VGW
Why it's wrong here
Incorrect; the VGW is attached and the VIF is associated.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.