ANS-C01 Network Design Practice Question
A company has a VPC peering connection between VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16). They have added routes in both route tables. However, instances in VPC A cannot ping instances in VPC B. The security groups and network ACLs allow ICMP. What is the most likely cause?
⚠ Common exam trap
Candidates often assume that simply creating a VPC peering connection and adding routes generically is sufficient, but they overlook the requirement that the route must explicitly point to the peering connection ID as the target, not just any route to the peer CIDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route tables in VPC A do not have a route to VPC B CIDR pointing to the peering connection
The question states that routes have been added in both route tables, but the most likely cause is that the route in VPC A's route table does not point to the VPC peering connection as the target. Without a specific route for VPC B's CIDR (10.1.0.0/16) with the peering connection ID as the target, traffic from VPC A to VPC B will not be forwarded over the peering link, even if security groups and NACLs permit ICMP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security groups in VPC B do not allow inbound ICMP from VPC A CIDR
Why it's wrong here
The question states security groups allow ICMP, so this is not the cause.
- ✓
The route tables in VPC A do not have a route to VPC B CIDR pointing to the peering connection
Why this is correct
Without a specific route to the peered VPC CIDR, traffic will not be sent over the peering connection.
- ✗
The VPC peering connection is not in the 'active' state
Why it's wrong here
If the peering connection is not active, the route tables would show the target as 'blackhole', but the question implies routes are added, so likely active.
- ✗
The instances are in different Availability Zones
Why it's wrong here
Availability Zones do not affect VPC peering; traffic between VPCs is independent of AZ.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.