ANS-C01 Network Design Practice Question
A company is designing a hybrid network using AWS Direct Connect. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The company needs to ensure that traffic from the VPC to the on-premises network uses the Direct Connect connection and that traffic does not traverse the internet. Which TWO actions are required? (Choose TWO.)
⚠ Common exam trap
Watch out — candidates often confuse public VIFs with private VIFs, thinking a public VIF can be used for on-premises connectivity, or they assume a Direct Connect Gateway is always required for any Direct Connect setup, even for a single VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private virtual interface (VIF) on the Direct Connect connection
A private virtual interface (VIF) is required to connect your VPC to an on-premises network over Direct Connect. It allows traffic to traverse the Direct Connect connection privately, bypassing the internet. Without a private VIF, you cannot route traffic from the VPC to the on-premises network over the Direct Connect link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach the VPC to an AWS Transit Gateway
Why it's wrong here
Transit Gateway is optional and not required for a simple Direct Connect setup with one VPC.
- ✓
Create a private virtual interface (VIF) on the Direct Connect connection
Why this is correct
Private VIF allows connectivity to the VPC via the Virtual Private Gateway.
- ✓
Configure static routes or BGP to advertise the on-premises CIDR to the VPC
Why this is correct
Routes must be exchanged over the VIF for the VPC to know how to reach on-premises.
- ✗
Create a public virtual interface (VIF) on the Direct Connect connection
Why it's wrong here
Public VIF is for accessing AWS public services, not private VPC communication.
- ✗
Create a Direct Connect Gateway to connect the VPC to the on-premises network
Why it's wrong here
Direct Connect Gateway is used for multi-VPC or multi-Region scenarios, but not required for a single VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.