ANS-C01 Network Implementation Practice Question
A company is setting up a site-to-site VPN connection between an on-premises network and AWS. The VPN uses two tunnels for high availability. The network engineer needs to ensure that if one tunnel goes down, traffic automatically fails over to the other tunnel. Which THREE steps should the engineer perform? (Choose THREE.)
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a single customer gateway device with multiple BGP sessions is sufficient for high availability, but the trap is that this only protects against tunnel failure, not device failure; the correct approach for full redundancy is to use two separate customer gateway devices, each with its own BGP session (Option D).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure BGP on both VPN tunnels.
BGP is the correct choice for automatic failover because it enables dynamic route advertisement and withdrawal over the VPN tunnels. When a tunnel fails, BGP withdraws the corresponding routes, causing the VPC route table to automatically use the remaining tunnel's routes. This eliminates the need for manual intervention or static route manipulation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure static routes pointing to the VPN connection.
Why it's wrong here
Static routes require manual intervention for failover.
- ✓
Configure BGP on both VPN tunnels.
Why this is correct
BGP provides automatic failover between tunnels.
- ✗
Use a single customer gateway device with multiple BGP sessions.
Why it's wrong here
Using a single customer gateway device with multiple BGP sessions does not satisfy the requirement for automatic failover between two separate VPN tunnels, because BGP sessions on the same device share the same physical path and endpoint; if the device or its connection fails, all BGP sessions are lost simultaneously. This option is tempting because multiple BGP sessions can provide load balancing or path diversity across different ISPs when the device has multiple WAN interfaces, but in this scenario the two tunnels must terminate on distinct, independent endpoints to achieve high availability.
- ✓
Configure two customer gateway devices on-premises, each with a separate BGP session.
Why this is correct
Redundant devices ensure availability.
- ✓
Enable route propagation on the VPC route table for the virtual private gateway.
Why this is correct
This allows BGP routes to be automatically added and removed.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is setting up AWS Site-to-Site VPN for connectivity between its on-premises network and AWS VPC. They want to ensure the VPN tunnel is highly available. Which THREE components should be configured? (Choose THREE.)
easy- A.A single VPN connection with one tunnel
- ✓ B.BGP dynamic routing over the VPN tunnels
- C.Static routing instead of BGP
- ✓ D.Two VPN tunnels per VPN connection
- ✓ E.A second customer gateway device on-premises
Why B: Options B, D, and E are correct. BGP dynamic routing enables automatic failover between VPN tunnels, ensuring high availability. Two VPN tunnels per VPN connection provide redundant paths in case one tunnel fails. A second customer gateway device on-premises eliminates the single point of failure at the on-premises side. Option A is incorrect because a single tunnel does not provide redundancy. Option C is incorrect because static routing does not support automatic failover like BGP does.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.