ANS-C01 Network Implementation Practice Question
A company is designing a hybrid network using AWS Direct Connect and a Site-to-Site VPN as a backup. The company has two Direct Connect connections from different providers for redundancy. The company wants to use BGP to automatically fail over to the VPN if both Direct Connect connections fail. Which TWO configurations are required to achieve this?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that you should set a higher local preference on the backup path (VPN) to make it preferred, but the correct approach is to make the primary path (Direct Connect) more preferred so that failover occurs only when the primary is unavailable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.
Setting a higher local preference on Direct Connect routes makes them more preferred over VPN routes under normal conditions. Option E is correct because dynamic BGP routing on the VPN is required to allow automatic failover and route advertisement when Direct Connect fails, enabling BGP to withdraw routes and trigger failover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set a higher local preference on the VPN route to make it preferred over Direct Connect.
Why it's wrong here
The VPN should be a backup, so it should have lower local preference.
- ✗
Configure the VPN connection with static routes instead of BGP.
Why it's wrong here
Static routes do not provide dynamic failover based on BGP attributes.
- ✗
Disable route propagation on the VPN connection's route table.
Why it's wrong here
Disabling propagation would remove the VPN routes, preventing failover.
- ✓
Adjust BGP attributes on the Direct Connect routes to be preferred over the VPN routes.
Why this is correct
By making Direct Connect routes more preferred (e.g., higher local preference), the VPN will only be used when Direct Connect is down.
- ✓
Use a VPN connection that supports dynamic BGP routing.
Why this is correct
BGP allows dynamic route advertisement and automatic failover.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.