ANS-C01 Network Implementation Practice Question
A company has a Direct Connect connection with a single private virtual interface (VIF) to a virtual private gateway (VGW) attached to a VPC. The VPC CIDR is 10.0.0.0/16. The on-premises CIDR is 172.16.0.0/12. The BGP session is established, and the on-premises router is advertising the 172.16.0.0/12 route to the VGW. The VGW is configured to propagate routes to the VPC route tables. However, instances in the VPC cannot reach on-premises resources. The VPC route table shows a propagated route for 172.16.0.0/12 with a target of the VGW. What is the most likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface
The on-premises router must also have a route back to the VPC CIDR via the Direct Connect interface for traffic to flow bidirectionally. Option A is wrong because security groups are stateful, so outbound traffic is automatically allowed. Option B is wrong because the VPC route table does contain the propagated route for 172.16.0.0/12. Option D is wrong because the BGP session is established and the VGW does not need to advertise the VPC CIDR for outbound traffic; the problem is the lack of a return route on the on-premises router.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security groups for the VPC instances do not allow outbound traffic to the on-premises network
Why it's wrong here
Security groups allow outbound by default.
- ✗
The VPC route table does not have a route for the on-premises CIDR
Why it's wrong here
The route is present.
- ✓
The on-premises router does not have a route to the VPC CIDR via the Direct Connect interface
Why this is correct
Without a return route, traffic cannot reach the VPC.
- ✗
The BGP session is not advertising the VPC CIDR to the on-premises router
Why it's wrong here
The issue is likely the return path.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.