ANS-C01 Network Implementation Practice Question
A company is setting up an AWS Client VPN endpoint for remote access. Users report they can connect to the VPN but cannot access resources in the VPC. The VPN endpoint is associated with a subnet that has a route table with a route to an internet gateway. The security group for the VPN endpoint allows all traffic. What could be the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table associated with the VPN subnet does not have a route to the VPC CIDR
The VPN endpoint is associated with a subnet, and that subnet's route table must include a route to the VPC CIDR to allow traffic from VPN clients to reach VPC resources. Without this route, packets from VPN clients are dropped because the subnet does not know how to forward them to the VPC. Option A is correct. Option B is incorrect because authorization rules control user access to specific destinations, but they do not affect routing; if the route is missing, traffic never reaches the VPC regardless of authorization. Option C is incorrect because the security group allows all traffic, so it is not blocking access. Option D is incorrect because while client CIDR overlap could cause issues, users can connect to the VPN, indicating no overlap; the primary issue is the missing route.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route table associated with the VPN subnet does not have a route to the VPC CIDR
Why this is correct
A route to the VPC CIDR via the VPN endpoint's network interface is required.
- ✗
The authorization rules for the VPN endpoint do not include the VPC CIDR
Why it's wrong here
Authorization rules control which networks users can access, but routing must be in place.
- ✗
The security group for the VPN endpoint does not allow outbound traffic
Why it's wrong here
Security group allows all traffic.
- ✗
The client CIDR range overlaps with the VPC CIDR
Why it's wrong here
Overlap would cause routing issues, but not the described symptom.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.