ANS-C01 Network Implementation Practice Question
A company is deploying a hybrid network architecture with an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The on-premises network uses BGP to advertise routes to the VPN connection. After the VPN is established, the on-premises network cannot reach EC2 instances in the VPC. The VPC route table has a route for the on-premises CIDR block pointing to the VPN gateway. What is the most likely cause of this issue?
⚠ Common exam trap
The trap here is that candidates often focus on security group or NACL misconfigurations, but the real issue is a routing conflict caused by BGP advertising a default route that overrides the VPC's local route, a classic hybrid networking pitfall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.
When the on-premises network advertises a default route (0.0.0.0/0) via BGP over the VPN connection, the VPC propagates that route into its route tables (if route propagation is enabled). This default route can override the VPC's local route for the on-premises CIDR, causing traffic destined for the on-premises network to be sent back out the VPN gateway instead of being delivered locally, effectively breaking connectivity to EC2 instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN connection is not using the correct pre-shared key.
Why it's wrong here
Incorrect pre-shared key would prevent the VPN tunnel from establishing, but the VPN is already established.
- ✗
The security group attached to the EC2 instances does not allow inbound traffic from the on-premises CIDR.
Why it's wrong here
Security groups are stateful; if the EC2 instance initiates outbound traffic, the return traffic is allowed regardless of inbound rules.
- ✓
The on-premises network is advertising a default route (0.0.0.0/0) via BGP, which is overriding the VPC's local route.
Why this is correct
BGP route propagation can cause the VPC route table to learn a default route from on-premises, which may cause traffic destined for the VPC CIDR to be sent back to the VPN gateway instead of staying local.
- ✗
The VPC's network ACLs are blocking inbound traffic from the on-premises network.
Why it's wrong here
Network ACLs are stateless and would affect traffic in both directions; however, the issue is routing, not filtering.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.