ANS-C01 Network Management and Operations Practice Question
A company has set up a Direct Connect connection with a private VIF to its VPC. The BGP session is up, but traffic is not passing between the on-premises network and the VPC. Which configuration should be verified?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the BGP advertised routes and the VPC route tables
For traffic to flow between on-premises and the VPC over a Direct Connect private VIF, the on-premises network must advertise the appropriate routes via BGP, and the VPC route tables must have routes pointing to the virtual private gateway (VGW). Option A is wrong because jumbo frames are not required for basic connectivity. Option B is wrong because the VIF type (private vs public) is not the issue—the BGP session is already up, indicating the VIF is correctly configured as private. Option C is wrong because CloudWatch metrics are for monitoring performance, not for diagnosing routing issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure jumbo frames are enabled on the Direct Connect interface
Why it's wrong here
Jumbo frames are optional and not required for basic connectivity.
- ✗
Verify that the VIF is a public VIF
Why it's wrong here
Private VIF is correct for VPC access; public VIF is for AWS public services.
- ✗
Review the Direct Connect virtual interface metrics in CloudWatch
Why it's wrong here
CloudWatch metrics show operational status, not routing configuration.
- ✓
Check the BGP advertised routes and the VPC route tables
Why this is correct
Routes must be properly advertised and propagated to the VPC route table.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a Direct Connect connection with a private virtual interface. The on-premises network team reports that they cannot reach EC2 instances in a VPC. The VPC has a virtual private gateway attached. The route table in the VPC has a route to the on-premises CIDR via the virtual private gateway. What should the network engineer verify?
medium- A.Verify that the Direct Connect virtual interface is in the 'available' state.
- B.Verify that the VPC route table has a route to the on-premises CIDR pointing to the virtual private gateway.
- ✓ C.Verify that the BGP session between the on-premises router and the VGW is established.
- D.Verify that the on-premises router is advertising the VPC CIDR.
Why C: Even though the VPC route table has the route to the on-premises CIDR via the virtual private gateway, the on-premises router cannot reach EC2 instances if the BGP session between the on-premises router and the VGW is not established. Without a functioning BGP session, the VGW cannot exchange routes with the on-premises router, causing connectivity failure. Options A and B are not the primary issue: A checks the virtual interface state, but the VIF could be available yet BGP down; B is already stated as present. Option D is incorrect because the on-premises router needs to receive the VPC CIDR route from the VGW via BGP, not advertise it back.
Variation 2. A company has a Direct Connect connection with multiple virtual interfaces (VIFs). They notice that traffic from on-premises to a VPC is being dropped. The VPC is associated with a private VIF. The on-premises router has a BGP route to the VPC's CIDR. The VPC's route table has a route to the virtual private gateway. What is the MOST likely cause of the dropped traffic?
hard- ✓ A.The VPC route table does not have a route pointing to the virtual private gateway for the on-premises CIDR
- B.The MTU size on the Direct Connect connection is too small
- C.The BGP session is not established
- D.The allowed prefixes on the virtual private gateway do not include the on-premises CIDR
Why A: For traffic to flow from on-premises to the VPC, the VPC must have a route back to the on-premises CIDR pointing to the virtual private gateway. Without that route, the return traffic will be dropped. Option B is incorrect because MTU issues typically cause packet fragmentation or loss, not complete drop due to missing routes. Option C is incorrect because the BGP session is established (as indicated by the BGP route being present). Option D is incorrect because allowed prefixes on the virtual private gateway control which routes can be advertised over BGP, not the return path in the VPC route table.
Variation 3. A company has a Direct Connect connection with a private VIF to a VPC. The on-premises network uses BGP to advertise the 10.0.0.0/8 prefix to AWS. The VPC has a route table that includes a route to the Virtual Private Gateway for 10.0.0.0/8. On-premises hosts can ping EC2 instances in the VPC, but EC2 instances cannot ping on-premises hosts. The VPC has an Internet Gateway and a NAT Gateway. The EC2 instances are in private subnets with routes to the NAT Gateway for 0.0.0.0/0. What is the most likely cause?
medium- A.The Direct Connect virtual interface is configured for public VIF instead of private VIF.
- B.The EC2 instances' security group outbound rules are blocking ICMP.
- ✓ C.The VPC route table has a more specific local route (10.0.0.0/16) that overrides the route to the VGW for part of the on-premises CIDR.
- D.The on-premises router is not advertising the 10.0.0.0/8 route to AWS.
Why C: For EC2 instances to reach on-premises hosts, the VPC route table must have a route for the on-premises CIDR pointing to the Virtual Private Gateway. The engineer has that route. However, the on-premises hosts are in the 10.0.0.0/8 range, and the VPC also uses 10.0.0.0/16. The issue is that the VPC route table has a local route for 10.0.0.0/16, which is more specific than the 10.0.0.0/8 route to the VGW. Traffic from EC2 to on-premises hosts within the 10.0.0.0/16 range will be routed locally within the VPC, not through the VGW. The on-premises hosts must be in a different CIDR than the VPC's CIDR, or the VPC must use a different CIDR. Since the VPC uses 10.0.0.0/16, any on-premises host with an IP in that range will be considered local and won't go through the VGW. The solution is to ensure the VPC CIDR does not overlap with the on-premises CIDR.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.