ANS-C01 Network Implementation Practice Question
A company is migrating on-premises workloads to AWS using AWS Direct Connect. The company has two Direct Connect connections from different providers for redundancy. Which configuration ensures seamless failover with automatic traffic rerouting?
⚠ Common exam trap
Candidates often assume both Direct Connect connections must terminate on the same Virtual Private Gateway (VGW) for redundancy, but AWS does not support multiple Direct Connect connections to a single VGW, making the dual Direct Connect gateway and Transit Gateway design the correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.
Using two Direct Connect gateways, each attached to a separate Transit Gateway, with the same BGP prefixes advertised from both connections enables active-active or active-passive failover via BGP path selection (e.g., AS_PATH prepending or MED). This design ensures automatic traffic rerouting if one connection fails, as BGP withdraws the failed path and the remaining path takes over without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create two Direct Connect gateways, each attached to a separate Transit Gateway, and advertise the same prefixes via BGP.
Why this is correct
Enables automatic failover using BGP path selection.
- ✗
Use one Direct Connect connection as primary and the other as standby with static routes.
Why it's wrong here
Static routes do not provide automatic failover.
- ✗
Connect both Direct Connect connections to the same Virtual Private Gateway (VGW) and enable BGP.
Why it's wrong here
Single point of failure at the VGW.
- ✗
Use a VPN connection over the internet as a backup for the Direct Connect links.
Why it's wrong here
Not a Direct Connect redundancy solution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Direct Connect with a private VIF to connect to a VPC. They also have a VPN connection as a backup. How should they configure BGP to ensure that the VPN is only used when Direct Connect fails?
hard- A.Use a lower local preference on the Direct Connect BGP session
- B.Use a lower AS path prepend on the VPN BGP session
- ✓ C.Use a higher local preference on the Direct Connect BGP session
- D.Use a higher MED on the VPN BGP session
Why C: Local preference is a BGP attribute used to influence outbound traffic from an AS. By setting a higher local preference on the Direct Connect BGP session, the router will prefer that path over the VPN session. When Direct Connect fails, the BGP session goes down, and the VPN route becomes the only available path, ensuring seamless failover.
Variation 2. A company is using AWS Direct Connect to connect its on-premises network to a VPC via a private virtual interface (VIF) attached to a virtual private gateway (VGW). The company wants to add redundant connectivity using a second Direct Connect connection from a different provider. The network team proposes using a Direct Connect gateway (DXGW) with two private VIFs from different connections, each attached to the DXGW. The DXGW will be associated with the VGW. Which THREE steps are required to complete this configuration? (Choose three.)
hard- A.Add routes to the VPC subnets' route tables pointing to the Direct Connect gateway.
- ✓ B.Associate both private virtual interfaces with the same Direct Connect gateway.
- ✓ C.Associate the Direct Connect gateway with the virtual private gateway.
- ✓ D.Advertise the on-premises prefixes over both BGP sessions to enable active-active or failover.
- E.Create a separate virtual private gateway for each Direct Connect connection.
Why B: To implement redundant Direct Connect connectivity using a Direct Connect gateway (DXGW), the correct steps are: associate both private virtual interfaces (VIFs) with the same DXGW (B), associate the DXGW with the virtual private gateway (VGW) (C), and advertise the on-premises prefixes over both BGP sessions to enable active-active or failover (D). Option A is incorrect because route tables in VPC subnets must point to the VGW, not the DXGW directly. Option E is incorrect because only one VGW is needed per VPC; separate VGWs would not provide the desired redundancy and would complicate routing.
Variation 3. A company uses AWS Direct Connect with a private VIF to connect to a VPC. The VPC has a virtual private gateway (VGW). The on-premises network uses BGP to advertise routes. The company wants to ensure high availability by using two Direct Connect connections from different providers. Both connections terminate at the same Direct Connect location (same AWS device). The company configures two private VIFs, each with a separate BGP session, and attaches both to the same VGW. However, when one connection fails, traffic does not fail over. What is the most likely cause?
hard- ✓ A.Both Direct Connect connections are on the same AWS device, creating a single point of failure
- B.The same BGP ASN is used for both VIFs, causing route conflict
- C.The MTU size is mismatched between the VIFs
- D.The allowed prefixes for the VIFs do not include the on-premises subnets
Why A: If both connections terminate at the same AWS Direct Connect location and same device, they share the same physical infrastructure. A failure at that location would affect both. True high availability requires connections at different locations. Also, BGP configuration may not have proper failover. The most likely cause is that both VIFs are on the same device, so a single point of failure exists. Option B (BGP ASN) is wrong because same ASN is allowed. Option C (allowed prefixes) would cause routes not to be accepted. Option D (MTU) would not cause complete failover failure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.