ANS-C01 Network Implementation Practice Question
A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network team reports that they can ping the VPC's private IP addresses, but they cannot reach an internet-facing application hosted on an EC2 instance in a public subnet. The EC2 instance has a public IP and a security group allowing HTTP/HTTPS from 0.0.0.0/0. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The private VIF does not route traffic to public IP addresses; the on-premises traffic to the public IP must traverse the internet.
The issue is that the private VIF (private virtual interface) is designed to route traffic only between private IP addresses, not public IP addresses. Even though the EC2 instance has a public IP and the security group allows HTTP/HTTPS from anywhere, traffic from on-premises destined for the public IP of the EC2 instance will not traverse the Direct Connect private VIF because the private VIF does not route public IP traffic. Instead, that traffic would need to go over the internet. Therefore, the most likely cause is that the private VIF does not route traffic to public IP addresses, as stated in option D. Option A is incorrect because the route table in the public subnet can have a default route to an internet gateway; that is not the issue. Option B is incorrect because the security group allows all inbound HTTP/HTTPS. Option C is incorrect because BGP exchanges routes for prefixes advertised over the VIF, but even if routes were exchanged, the private VIF would not route public IP traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The route table in the public subnet does not have a default route to an internet gateway.
Why it's wrong here
The application is reachable from the internet, so the route table must have a default route to the IGW.
- ✗
The security group is blocking traffic from the on-premises IP range.
Why it's wrong here
The security group allows all inbound HTTP/HTTPS from 0.0.0.0/0, so it is not blocking traffic.
- ✗
The BGP session is not exchanging routes for the public IP range.
Why it's wrong here
BGP exchanges private IP prefixes; public IPs are not advertised over private VIF.
- ✓
The private VIF does not route traffic to public IP addresses; the on-premises traffic to the public IP must traverse the internet.
Why this is correct
A private VIF only carries traffic destined to private IP addresses in the VPC. Traffic to public IPs must go over the internet.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.