ANS-C01 Network Design Practice Question
A company has a VPC with a CIDR of 10.0.0.0/16. They need to connect to two on-premises data centers, each with overlapping CIDR blocks (192.168.0.0/16). The company wants to use AWS Site-to-Site VPN with dynamic routing (BGP). Which design allows the VPC to reach both data centers without route conflicts?
⚠ Common exam trap
AWS often tests the misconception that a single virtual private gateway can handle overlapping CIDRs by using BGP attributes like AS_PATH prepending, but the fundamental limitation is that the VPG's route table cannot store duplicate prefixes, regardless of BGP attributes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create two separate virtual private gateways, each in a different VPC, and use VPC peering. Alternatively, use a transit gateway with separate VPN attachments and BGP communities to tag routes.
Overlapping CIDR blocks cannot be advertised to the same virtual private gateway (VPG) without causing route conflicts. By using a transit gateway with separate VPN attachments, each data center's routes are isolated in separate route tables, and BGP communities can be used to tag and differentiate routes. This design allows the VPC to reach both data centers by leveraging the transit gateway's ability to manage overlapping prefixes through separate route tables and path selection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create two VPN connections to a single virtual private gateway and advertise the same CIDR from both data centers. Use BGP AS_PATH prepending to influence routing.
Why it's wrong here
Overlapping CIDRs will cause route conflicts; BGP AS_PATH prepending does not solve the overlap.
- ✗
Create a single VPN connection with two tunnels to the same virtual private gateway. Use different BGP ASNs for each data center.
Why it's wrong here
Still one VPN connection, cannot handle overlapping routes.
- ✓
Create two separate virtual private gateways, each in a different VPC, and use VPC peering. Alternatively, use a transit gateway with separate VPN attachments and BGP communities to tag routes.
Why this is correct
Transit gateway with separate attachments and BGP communities can handle overlapping CIDRs by using route priority or filtering.
- ✗
Create two VPN connections to the same virtual private gateway. Use static routes with different metric values.
Why it's wrong here
Static routes cannot handle dynamic overlapping routes; BGP required.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.