ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a hybrid network architecture with an AWS Direct Connect connection between its on-premises data center and an Amazon VPC. The VPC has a single private subnet with Amazon EC2 instances running a critical application. The on-premises network uses BGP to advertise a route for the VPC's CIDR (10.0.0.0/16) to the on-premises routers. Recently, the company added a new application in a second VPC (VPC-B) with CIDR 10.1.0.0/16 and peered it with the original VPC (VPC-A). After the peering, users on-premises can still reach resources in VPC-A, but cannot reach resources in VPC-B. The VPC-A route table has a route for VPC-B's CIDR pointing to the peering connection. The VPC-B route table has a route for VPC-A's CIDR pointing to the peering connection. The on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface. What is the most likely cause of the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises network is not advertising VPC-B's CIDR to the VPC via BGP, so VPC-B does not have a route back to on-premises.
The on-premises network is not advertising VPC-B's CIDR via BGP over Direct Connect. While the on-premises routers have a static route for VPC-B's CIDR pointing to the Direct Connect virtual interface, this only directs traffic from on-premises to VPC-B. For return traffic from VPC-B to on-premises, VPC-B needs a route to the on-premises network. Normally, this route would be learned via BGP over Direct Connect if the on-premises network advertised the VPC-B CIDR to the VPC. Without that advertisement, VPC-B does not have a route back to on-premises, causing the connectivity failure. Option A is incorrect because the VPC peering connection is working: VPC-A and VPC-B can communicate, as the issue is only with on-premises reachability. Option C is incorrect because security groups are stateful; if traffic from on-premises reached VPC-B, the return traffic would be automatically allowed. The issue is routing, not security. Option D is incorrect because route propagation for the virtual private gateway only affects VPC-A (if it is attached to the VGW), not VPC-B, which is connected via peering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC peering connection is not properly configured.
Why it's wrong here
The peering is configured correctly as VPCs can communicate with each other.
- ✓
The on-premises network is not advertising VPC-B's CIDR to the VPC via BGP, so VPC-B does not have a route back to on-premises.
Why this is correct
VPC-B needs a route to on-premises CIDR pointing to the virtual private gateway, but that route must be propagated via BGP or added manually.
- ✗
The security group on VPC-B instances is blocking inbound traffic from on-premises IP ranges.
Why it's wrong here
Security groups are stateful and would not block return traffic if outbound is allowed.
- ✗
The virtual private gateway does not have route propagation enabled for VPC-B.
Why it's wrong here
Route propagation is for the VGW to propagate routes to VPC route tables; VPC-B is not attached to the same VGW.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.