ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with a CIDR block of 10.0.0.0/16. They have an AWS Site-to-Site VPN connection to an on-premises network with a CIDR of 192.168.0.0/16. The VPN is configured with dynamic routing (BGP). The on-premises network advertises a route to 192.168.0.0/16 via BGP. The VPC route table has a static route to 192.168.0.0/16 pointing to a virtual private gateway. The company also has a Direct Connect connection to the same on-premises network advertising the same CIDR. The VPC route table has a propagated route to 192.168.0.0/16 pointing to a Direct Connect virtual interface, learned via BGP. Which route will be used for traffic destined to 192.168.0.0/16?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic will use the VPN connection because the static route to the virtual private gateway takes precedence over the propagated route from Direct Connect.
In AWS, when a VPC route table has both a static route and a propagated route (learned via BGP) for the same destination, the static route takes precedence regardless of the gateway type. In this scenario, the VPN route is a static route pointing to the virtual private gateway, while the Direct Connect route is a propagated route automatically added via BGP from the Direct Connect virtual interface. Therefore, the static route to the VPN gateway is used. Note that AWS does not allow two static routes with the same destination in the same route table; thus the Direct Connect route must be propagated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Traffic will use the VPN connection because the static route to the virtual private gateway takes precedence over the propagated route from Direct Connect.
Why this is correct
In AWS route tables, static routes have a higher priority than propagated routes. Therefore, the static route to the VPN wins.
- ✗
Traffic will use the VPN connection because the static route to the virtual private gateway has a lower prefix.
Why it's wrong here
Static routes have higher precedence than propagated routes, but the prefix length is the same.
- ✗
Traffic will use the Direct Connect connection because it is a more reliable connection.
Why it's wrong here
Reliability does not determine routing precedence; static routes take precedence over propagated routes.
- ✗
Traffic will be load-balanced between VPN and Direct Connect.
Why it's wrong here
AWS does not load balance between two different gateways for the same destination when one is static and one is propagated; the static route is used.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.