ANS-C01 Network Design Practice Question
A company has an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The tunnel status is up, but traffic from on-premises cannot reach an EC2 instance in the VPC. The instance's security group allows inbound traffic from the on-premises CIDR. Which configuration should be checked first?
⚠ Common exam trap
The trap here is that candidates often jump to checking BGP or tunnel status first, but the tunnel being up only confirms Layer 3 connectivity between the VPN endpoints, not that the VPC has a valid route to forward traffic back to on-premises.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.
For traffic from on-premises to reach an EC2 instance in a VPC via a Site-to-Site VPN, the VPC route table must contain a route pointing the on-premises CIDR to the VPN gateway (virtual private gateway or transit gateway). Without this route, the VPC has no path to send return traffic back to on-premises, causing asymmetric routing and connectivity failure even if the tunnel is up.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure the VPN connection is attached to a transit gateway instead of a virtual private gateway.
Why it's wrong here
VPN can be attached to either; both work. The attachment type is not the first check.
- ✗
Check the network ACL associated with the EC2 instance's subnet to ensure it allows inbound traffic from on-premises.
Why it's wrong here
While important, routing is the first thing to check; network ACLs are stateless and may block traffic, but routing is the more common issue.
- ✓
Verify that the VPC route table includes a route to the on-premises CIDR with the VPN gateway as target.
Why this is correct
Traffic from on-premises enters the VPC via VPN, but the return traffic needs a route back to the VPN gateway.
- ✗
Confirm that BGP session is established and exchanging routes.
Why it's wrong here
Tunnel status up indicates BGP may be working, but routes might not be propagated to the VPC route table.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.