ANS-C01 Floating static route Practice Question
A company is designing a hybrid network with AWS Direct Connect and AWS Site-to-Site VPN as backup. The primary Direct Connect connection uses a private VIF to a VPC. If the Direct Connect fails, traffic should automatically fail over to the VPN connection. What is the MOST reliable way to achieve this failover?
⚠ Common exam trap
A common mistake is to prepend AS paths on the primary Direct Connect connection, which would make it less preferred and cause the VPN to become the primary path. Always prepend on the backup connection to deprioritize it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use BGP on both connections and prepend AS paths on the VPN routes to make them less preferred.
Using BGP on both connections allows for dynamic routing and automatic failover. By prepending AS paths on the VPN routes, you make the VPN path less preferred, ensuring that Direct Connect is the primary path. If Direct Connect fails, the BGP session drops and the VPN routes become active. This method provides symmetric failover in both directions and is recommended by AWS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use BGP on Direct Connect and static routes on the VPN connection, with a higher metric for the VPN static route.
Why it's wrong here
Correct. Using BGP on Direct Connect with a floating static route for VPN provides automatic failover. The static route has a higher administrative distance, so it is only used when the BGP route is absent.
- ✗
Configure static routes on the customer gateway device with a lower metric for the Direct Connect interface.
Why it's wrong here
Incorrect. Configuring static routes with a lower metric for Direct Connect does not dynamically detect failure of the Direct Connect link; the static route remains even if the link is down, potentially causing traffic to be black-holed.
- ✓
Use BGP on both connections and prepend AS paths on the VPN routes to make them less preferred.
Why this is correct
Incorrect. Prepending AS paths on Direct Connect routes makes them less preferred, causing VPN to be used as primary, which contradicts the requirement that Direct Connect be primary.
- ✗
Use BGP on both connections and set a lower local preference on the Direct Connect routes.
Why it's wrong here
Incorrect. Setting a lower local preference on Direct Connect routes makes them less preferred, again making VPN the primary path, which is not desired.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.