ANS-C01 Network Implementation Practice Question
A company is implementing a hybrid network with AWS Direct Connect and a VPN connection as backup. They have a Direct Connect gateway (DXGW) attached to a private VIF and a virtual private gateway (VGW) attached to a VPN connection. The VPC is attached to the VGW. They want to use the Direct Connect connection for all traffic when available. The on-premises router advertises the same prefix over both connections. However, traffic from on-premises to the VPC is using the VPN connection. BGP is configured correctly on both connections. What should the company do to prefer the Direct Connect path?
⚠ Common exam trap
Many candidates confuse BGP attributes that influence outbound traffic (weight, local preference) with those that influence inbound traffic (MED), leading them to incorrectly select options A or B instead of the correct MED-based solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a lower MED (Multi-Exit Discriminator) on the Direct Connect VIF.
The Multi-Exit Discriminator (MED) is a BGP attribute used to influence inbound traffic from an AS to the local AS. By setting a lower MED on the Direct Connect VIF, the on-premises router will prefer the Direct Connect path over the VPN path when both advertise the same prefix, assuming all other BGP path selection criteria are equal. This directly addresses the requirement to prefer the Direct Connect connection for all traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set a higher weight on the Direct Connect BGP session.
Why it's wrong here
Weight is a Cisco-specific attribute and not used in AWS Direct Connect BGP.
- ✗
Set a higher local preference on the Direct Connect VIF.
Why it's wrong here
Local preference is used for outbound traffic from the VPC to on-premises, not for inbound traffic.
- ✗
Change the BGP timers on the Direct Connect VIF to have a lower hold time.
Why it's wrong here
BGP timers do not affect path selection.
- ✗
Configure AS_PATH prepending on the VPN BGP session.
Why it's wrong here
Prepending on the VPN would make the path longer, but the Direct Connect path should be preferred; this could work but is not the most straightforward.
- ✓
Configure a lower MED (Multi-Exit Discriminator) on the Direct Connect VIF.
Why this is correct
Lower MED is preferred for inbound traffic; setting a lower MED on the Direct Connect VIF will make it the preferred path.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a Direct Connect connection with a private virtual interface (VIF) to a VPC. The on-premises network uses BGP to advertise a route for 10.0.0.0/8. The VPC CIDR is 10.1.0.0/16. The company wants to ensure that all traffic from the VPC to on-premises uses the Direct Connect connection, but if the Direct Connect fails, traffic should fail over to a VPN connection. Which configuration achieves this?
hard- A.Create a static route in the VPC route table pointing to the VPN with a metric of 100, and let BGP propagate the Direct Connect route.
- ✓ B.Configure a BGP local preference of 200 on the Direct Connect VIF and 100 on the VPN connection, and use the same ASN for both.
- C.Set the MED attribute on the Direct Connect VIF to 100 and on the VPN to 200.
- D.Configure AS path prepend on the Direct Connect side to advertise a longer AS path.
Why B: B is correct because BGP local preference is an administrative weight used to prefer one path over another within the same AS. By setting a higher local preference (200) on the Direct Connect VIF and a lower value (100) on the VPN, the on-premises router will prefer the Direct Connect path for outbound traffic. If the Direct Connect fails, the BGP session drops, and the VPN route with the lower local preference becomes active, providing failover. Using the same ASN for both connections ensures the routes are compared as equal under BGP best-path selection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.