ANS-C01 Network Management and Operations Practice Question
A company is designing a VPN connection between an on-premises network and AWS. The network engineer wants to ensure high availability and fast failover. Which TWO actions should the engineer take? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels
To ensure high availability and fast failover for a VPN connection between on-premises and AWS, the correct actions are D and E. Option D: Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels. BGP provides dynamic route exchange and automatic failover, while BFD offers fast failure detection (<1 second). Option E: Configure two VPN tunnels to two different AWS endpoint IP addresses. This provides redundancy at the AWS side, so if one endpoint fails, the other tunnel remains active. Option A is incorrect because using the same customer gateway IP for both tunnels creates a single point of failure; if that IP becomes unreachable, both tunnels go down. Option B is incorrect because static routes cannot dynamically adapt to failures, and BGP is needed for automatic failover. Option C is incorrect because creating two separate VPN connections to the same VPC is unnecessary and more complex; a single VPN connection with two tunnels to different endpoints achieves the same redundancy with simpler management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the same customer gateway IP address for both tunnels
Why it's wrong here
This is incorrect because using the same customer gateway IP address for both tunnels creates a single point of failure; if that IP becomes unreachable, both tunnels go down.
- ✗
Use static routes instead of BGP to simplify configuration
Why it's wrong here
Static routes cannot dynamically adapt to failures. BGP is required for automatic failover and route propagation, ensuring high availability.
- ✗
Create two separate VPN connections to the same VPC
Why it's wrong here
Creating two separate VPN connections to the same VPC does not satisfy the requirement for fast failover because both connections terminate on the same virtual private gateway, creating a single point of failure at the AWS side; a gateway failure would drop both tunnels simultaneously. This option is tempting because it mirrors a common on-premises design where dual routers provide redundancy, and it would be correct if the goal were merely to increase aggregate bandwidth or provide a backup path through a different on-premises device, rather than eliminating the AWS-side gateway as a failure domain.
- ✓
Enable BGP and configure BFD (Bidirectional Forwarding Detection) on the VPN tunnels
Why this is correct
Enabling BGP with BFD provides dynamic route exchange and fast failure detection (<1 second), enabling quick failover and high availability.
- ✓
Configure two VPN tunnels to two different AWS endpoint IP addresses
Why this is correct
Configuring two VPN tunnels to two different AWS endpoint IP addresses provides redundancy at the AWS side. If one endpoint fails, the other tunnel remains active, ensuring continuous connectivity.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure high availability by using two tunnels. Which two components must be configured to achieve this? (Choose TWO.)
medium- A.A single customer gateway with two IP addresses
- B.An AWS Transit Gateway
- C.Two customer gateways, each with a unique public IP address
- D.Two VPN connections
- ✓ E.A virtual private gateway with two BGP sessions
Why E: For high availability with two tunnels in an AWS Site-to-Site VPN, a single VPN connection provides two tunnels by default, terminating on two different AWS endpoints. This requires only one customer gateway with a single public IP address. The virtual private gateway must be configured with two BGP sessions (one per tunnel) to support dynamic routing and automatic failover. Option C is incorrect because two customer gateways are unnecessary; one customer gateway with one IP suffices. Option D is incorrect because two VPN connections are not required—a single VPN connection already provides two tunnels. Option A is incorrect because a customer gateway cannot have two IP addresses. Option B is incorrect because an AWS Transit Gateway is optional and not required for a basic HA VPN setup.
Variation 2. A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The engineer wants to ensure that if the primary VPN tunnel goes down, traffic automatically fails over to the secondary tunnel. Which configuration is required?
easy- A.Use static routes with equal-cost multipath (ECMP)
- B.Enable VPN CloudHub
- ✓ C.Enable dynamic routing (BGP) on the VPN connection
- D.Configure a second customer gateway device
Why C: Dynamic routing with BGP enables automatic failover between VPN tunnels because BGP advertises routes and automatically withdraws them when a tunnel fails, causing the routing table to update and traffic to use the other tunnel. Static routes (A) require manual intervention for failover, as they do not dynamically adapt. VPN CloudHub (B) is designed to interconnect multiple VPN connections, not for failover between tunnels. Configuring a second customer gateway device (D) is necessary for redundancy but does not itself enable automatic failover without BGP.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.