ANS-C01 Network Design Practice Question
A company has a VPC with a CIDR of 10.0.0.0/16. It creates a subnet 10.0.1.0/24 in us-east-1a and launches an EC2 instance with a private IP 10.0.1.10. The instance needs to send traffic to an on-premises server at 192.168.1.50 over a Direct Connect private VIF. The VPC has a virtual private gateway attached and a route table associated with the subnet. Which TWO entries must exist in the route table for the traffic to succeed?
⚠ Common exam trap
The trap is that candidates might think a default route to a NAT gateway or internet gateway is required for any outbound traffic, but the question specifically asks only about traffic to the on-premises server. The correct required routes are only the local route and the specific route to the on-premises network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Destination: 10.0.0.0/16, Target: local
For traffic from an EC2 instance in a VPC to an on-premises server over a Direct Connect private VIF, the route table must include two entries: a local route for the VPC CIDR (10.0.0.0/16) which is automatically added and enables communication within the VPC (Option C), and a specific route to the on-premises network (192.168.1.0/24) pointing to the virtual private gateway (vgw-xxxxxxxx) so that traffic destined for 192.168.1.50 is directed over the Direct Connect (Option D). No other entries are required; the local route already covers all subnets, and there is no need for a default route to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Destination: 0.0.0.0/0, Target: igw-xxxxxxxx
Why it's wrong here
Incorrect. A default route to an internet gateway would send all internet-bound traffic to the internet, but the on-premises traffic is not internet-bound and must go through the virtual private gateway.
- ✗
Destination: 0.0.0.0/0, Target: nat-xxxxxxxx
Why it's wrong here
Incorrect. A default route to a NAT gateway is used for private subnets to access the internet, but it is not required for traffic to on-premises over Direct Connect. The question does not mention any need for internet access.
- ✓
Destination: 10.0.0.0/16, Target: local
Why this is correct
Correct. The local route for the VPC CIDR is automatically added and allows the instance to communicate within the VPC. This is necessary as the instance sends traffic to the on-premises server, and the route table must have a local entry for the VPC.
- ✓
Destination: 192.168.1.0/24, Target: vgw-xxxxxxxx
Why this is correct
Correct. A specific route for the on-premises network (192.168.1.0/24) pointing to the virtual private gateway ensures that traffic destined for the on-premises server is routed over the Direct Connect private VIF.
- ✗
Destination: 10.0.1.0/29, Target: local
Why it's wrong here
Incorrect CIDR; the local route covers the whole VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.