ANS-C01 Network Design Practice Question
A company is designing a hybrid network using AWS Direct Connect and AWS Site-to-Site VPN as backup. They want to ensure that traffic from on-premises to AWS uses Direct Connect when available and fails over to VPN automatically. Which BGP configuration should be used?
⚠ Common exam trap
AWS often tests the misconception that MED is used to influence inbound traffic preference from a single AS, but here the trap is that candidates confuse MED (which is compared only for paths from the same neighboring AS) with AS path prepending, which works across different AS paths and is the correct method for this failover design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Prepend AS path on the VPN connection to make it less preferred.
Prepending the AS path on the VPN connection increases the AS path length, making the VPN route less preferred compared to the Direct Connect route. BGP selects the path with the shortest AS path length by default, so the Direct Connect path will be chosen as the primary path. When Direct Connect fails, the VPN route becomes the only available path and traffic automatically fails over.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set a higher BGP local preference on the VPN connection.
Why it's wrong here
Higher local preference is more preferred, which would prefer VPN over Direct Connect.
- ✓
Prepend AS path on the VPN connection to make it less preferred.
Why this is correct
Longer AS path is less preferred, so Direct Connect will be chosen.
- ✗
Use the same BGP attributes for both connections and let ECMP handle load balancing.
Why it's wrong here
ECMP would load share, not provide active/backup.
- ✗
Set a higher Multi-Exit Discriminator (MED) on the Direct Connect connection.
Why it's wrong here
Higher MED is less preferred, which would make Direct Connect less preferred.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a hybrid network with AWS Direct Connect and AWS Site-to-Site VPN as backup. The primary Direct Connect connection uses a private VIF to a VPC. If the Direct Connect fails, traffic should automatically fail over to the VPN connection. What is the MOST reliable way to achieve this failover?
medium- A.Use BGP on Direct Connect and static routes on the VPN connection, with a higher metric for the VPN static route.
- B.Configure static routes on the customer gateway device with a lower metric for the Direct Connect interface.
- ✓ C.Use BGP on both connections and prepend AS paths on the VPN routes to make them less preferred.
- D.Use BGP on both connections and set a lower local preference on the Direct Connect routes.
Why C: Using BGP on both connections allows for dynamic routing and automatic failover. By prepending AS paths on the VPN routes, you make the VPN path less preferred, ensuring that Direct Connect is the primary path. If Direct Connect fails, the BGP session drops and the VPN routes become active. This method provides symmetric failover in both directions and is recommended by AWS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.