ANS-C01 Network Implementation Practice Question
A company has an AWS Direct Connect connection with a private VIF to a VPC. The VPC has multiple subnets across two Availability Zones. The company wants to use the Direct Connect connection as the primary path for all traffic from on-premises to the VPC, and use a Site-to-Site VPN as a backup. The on-premises router is configured to advertise a default route via BGP over the Direct Connect, and the VPN also advertises a default route. Which configuration ensures that the Direct Connect path is preferred over the VPN?
⚠ Common exam trap
Test-takers frequently confuse local preference (which influences outbound traffic from on-premises) with AS_PATH prepending (which influences inbound traffic to the VPC), and they may incorrectly assume that disabling route propagation or adjusting MED is the correct way to prioritize Direct Connect over VPN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure AS_PATH prepending on the VPN BGP advertisements from the on-premises router to make the VPN path longer.
AS_PATH prepending increases the AS path length for routes advertised over the VPN, making them less preferred compared to the Direct Connect routes when both paths advertise a default route. BGP selects the path with the shortest AS_PATH length when all other attributes are equal, so prepending on the VPN ensures Direct Connect is the primary path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable route propagation from the VPN in the VPC route tables to ensure Direct Connect routes take precedence.
Why it's wrong here
This would remove VPN routes altogether, not provide failover.
- ✗
Set a higher local preference on the Direct Connect BGP session on the on-premises router.
Why it's wrong here
Local preference is not directly controlled by AWS configuration.
- ✗
Decrease the Multi-Exit Discriminator (MED) value on the Direct Connect BGP advertisements from AWS.
Why it's wrong here
MED is not typically set by AWS; it's more common to adjust on-premises.
- ✓
Configure AS_PATH prepending on the VPN BGP advertisements from the on-premises router to make the VPN path longer.
Why this is correct
Longer AS_PATH makes the route less preferred.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. They have also set up a Site-to-Site VPN as a backup. The VPC has a virtual private gateway (VGW) attached. The on-premises network uses BGP over the Direct Connect and static routes for the VPN. The network engineer notices that traffic from the VPC to on-premises is not using the Direct Connect when it is available; instead, it goes over the VPN. The VPC route table has a route for the on-premises CIDR (10.0.0.0/8) to the VGW. The VPN connection is configured with static routes. What is the MOST likely cause of this behavior?
medium- ✓ A.The VPN static route has higher precedence than the BGP route from Direct Connect
- B.The VPC route table does not have a route for the on-premises CIDR
- C.The VGW is not attached to the VPC
- D.The Direct Connect virtual interface is not associated with the VGW
Why A: When a VPC route table has a route for the on-premises CIDR (10.0.0.0/8) pointing to the VGW, AWS uses the longest prefix match to select the route. If both the Direct Connect BGP route and the VPN static route have the same prefix length, static routes are preferred over propagated BGP routes. Therefore, the VPN static route takes precedence, causing traffic to flow over the VPN even when Direct Connect is available. To fix this, the VPN should use BGP instead of static routes, or the static route should be removed so that the BGP route from Direct Connect is used.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.