ANS-C01 Network Design Practice Question
A company has a VPC with CIDR 10.0.0.0/16 and needs to connect to an on-premises network using AWS Direct Connect. The on-premises CIDR is 10.1.0.0/16. To enable communication between the VPC and on-premises, which component must be configured?
⚠ Common exam trap
AWS often tests the misconception that a Transit Gateway is always required for Direct Connect, but the exam trap here is that a Virtual Private Gateway is the fundamental component for terminating a Direct Connect private VIF to a single VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a Virtual Private Gateway to the VPC and update route tables
To connect a VPC to an on-premises network over AWS Direct Connect, you must attach a Virtual Private Gateway (VGW) to the VPC. The VGW serves as the VPN concentrator on the AWS side, terminating the Direct Connect virtual interface (VIF) and enabling BGP peering for route exchange. You then update the VPC route tables to point the on-premises CIDR (10.1.0.0/16) to the VGW, allowing traffic to flow between the VPC and the on-premises network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an Internet Gateway to the VPC and configure a NAT gateway
Why it's wrong here
An Internet Gateway is for internet access, not for private connectivity to on-premises.
- ✗
Create a VPC peering connection between the VPC and the on-premises network
Why it's wrong here
VPC peering is only for connecting VPCs within AWS, not for connecting to on-premises networks.
- ✓
Attach a Virtual Private Gateway to the VPC and update route tables
Why this is correct
A Virtual Private Gateway is required for Direct Connect connectivity, and appropriate routes must be added in the VPC route tables to route traffic to the on-premises network via the VGW.
- ✗
Create a Transit Gateway and attach the VPC and Direct Connect
Why it's wrong here
A Transit Gateway is not strictly required for connecting a single VPC to an on-premises network via Direct Connect. For this scenario, a Direct Connect Gateway can directly attach to the VPC's Virtual Private Gateway, establishing the necessary connectivity. This option is tempting as Transit Gateway centralises network connectivity, making it the correct choice for complex architectures involving multiple VPCs, multiple Direct Connect connections, or hybrid cloud setups requiring scalable, hub-and-spoke routing.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.