ANS-C01 Network Implementation Practice Question
A company is setting up a Direct Connect connection to connect its on-premises data center to AWS. The connection is established, and a private virtual interface (VIF) is configured. The on-premises router can ping the VIF's Amazon side IP address, but cannot ping an EC2 instance in the VPC. The VPC has a virtual private gateway attached, and the route tables are correctly configured. What should the company check next?
⚠ Common exam trap
Test-takers frequently assume BGP being established (as evidenced by a successful ping to the VIF Amazon side IP) means all routing is correct, but they overlook the requirement for the on-premises router to advertise the VPC CIDR to enable return traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.
The on-premises router can ping the VIF's Amazon side IP, confirming that Layer 2 and Layer 3 connectivity over the Direct Connect link is working, and BGP is established. However, the inability to ping the EC2 instance indicates that return traffic from the VPC is not reaching the on-premises network. For return traffic to be routed correctly, the on-premises router must advertise the VPC CIDR (or a specific prefix) to the Direct Connect router via BGP; otherwise, the AWS side will not forward traffic destined for the on-premises network over the VIF.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify that the on-premises router is advertising the VPC CIDR to the Direct Connect router.
Why this is correct
The on-premises router must advertise the VPC CIDR for return traffic.
- ✗
Check that the NACLs on the EC2 instance's subnet allow inbound ICMP.
Why it's wrong here
NACLs are stateless and may block traffic, but the question states routes are correct.
- ✗
Confirm that the private VIF is associated with the correct virtual private gateway.
Why it's wrong here
The VIF is already configured and ping to Amazon side works.
- ✗
Ensure that BGP is established and receiving routes.
Why it's wrong here
Pinging the Amazon side IP suggests BGP is up.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.