ANS-C01 Network Implementation Practice Question
A company is deploying an AWS Client VPN endpoint to provide remote access to its VPC resources. The company wants to allow clients to access resources in multiple subnets within the VPC. Which TWO configurations are necessary?
⚠ Common exam trap
Many candidates confuse authorization rules (which control access to target networks) with network connectivity requirements, leading them to think that only subnet association is needed, or they mistakenly believe that VPC route tables must be manually configured to point to the Client VPN endpoint, when in fact the endpoint automatically propagates routes into the associated subnet route tables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate the Client VPN endpoint with subnets in the VPC.
Associating the Client VPN endpoint with subnets in the VPC is required to establish the network connectivity between the VPN clients and the VPC. The Client VPN endpoint uses elastic network interfaces in the associated subnets to route traffic from clients into the VPC. Without this association, the endpoint cannot forward traffic to VPC resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure route tables in the VPC to direct traffic to the Client VPN endpoint.
Why it's wrong here
Routes are automatically added when the endpoint is associated with subnets.
- ✓
Associate the Client VPN endpoint with subnets in the VPC.
Why this is correct
Subnet associations allow the endpoint to have elastic network interfaces in those subnets.
- ✓
Create authorization rules to allow access to the target networks.
Why this is correct
Authorization rules define which users can access which networks.
- ✗
Attach the VPC to a transit gateway.
Why it's wrong here
A transit gateway is not required for Client VPN.
- ✗
Configure security groups on the target subnets.
Why it's wrong here
Security groups are applied to the VPN endpoint, not subnets.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?
medium- ✓ A.The authorization rules allow access to the VPC's CIDR.
- ✓ B.The Client VPN endpoint is associated with the correct subnets.
- C.The Client VPN endpoint has a public IP address.
- ✓ D.The security groups attached to the target resources allow traffic from the VPN CIDR.
- E.The client certificate is issued by a valid CA.
Why A: Authorization rules in AWS Client VPN define which networks (CIDRs) users are allowed to access. If the rule does not include the VPC's CIDR, traffic to resources in the VPC will be dropped even though the VPN tunnel is established. This is a common misconfiguration that prevents resource reachability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.