ANS-C01 Network Implementation Practice Question
A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?
⚠ Common exam trap
The trap here is that candidates see 'VPN tunnel status UP' and assume connectivity is fully functional, overlooking the critical requirement of a VPC route pointing to the virtual private gateway for traffic to traverse the tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the VPC route table has a route to the on-premises network via the virtual private gateway
Even though the VPN tunnel is 'UP', traffic from the VPC to the on-premises network must be routed through the virtual private gateway (VGW). If the VPC route table does not contain a route for the on-premises CIDR (e.g., 192.168.1.0/24) pointing to the VGW, the instances have no path to reach the on-premises server, regardless of tunnel status.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the internet gateway is attached to the VPC
Why it's wrong here
Internet gateway is not used for VPN traffic.
- ✓
Verify that the VPC route table has a route to the on-premises network via the virtual private gateway
Why this is correct
Without this route, traffic from VPC to on-premises is dropped.
- ✗
Verify that the security group for the instances allows outbound ICMP
Why it's wrong here
Security groups are stateful and allow outbound traffic by default.
- ✗
Verify that the VPN tunnel is up on both ends
Why it's wrong here
The tunnel is already UP.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.