ANS-C01 Network Implementation Practice Question
A company is setting up an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a virtual private gateway (VGW) attached, and the VPN connection uses two tunnels for redundancy. The on-premises customer gateway (CGW) is configured with the public IP address of the on-premises VPN device. The VPN tunnels are up and BGP sessions are established. However, the company cannot ping an EC2 instance in the VPC from an on-premises server. The security group for the EC2 instance allows ICMP from the on-premises network CIDR. What is the MOST likely cause of the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.
The VPC subnet route tables must have a route pointing to the VGW for the on-premises CIDR. Option B is incorrect because BGP is established. Option C is incorrect because the CGW is configured correctly. Option D is incorrect because the VPN connection does not have a security group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.
Why this is correct
Without a route, traffic from VPC to on-premises is dropped.
- ✗
The customer gateway is configured with an incorrect private IP address.
Why it's wrong here
CGW uses public IP.
- ✗
The VPN connection's security group is blocking ICMP traffic.
Why it's wrong here
VPN connections do not have security groups.
- ✗
The BGP session is not advertising the on-premises routes to the VGW.
Why it's wrong here
Stem says BGP is established, so routes should be advertised.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?
easy- A.Verify that the internet gateway is attached to the VPC
- ✓ B.Verify that the VPC route table has a route to the on-premises network via the virtual private gateway
- C.Verify that the security group for the instances allows outbound ICMP
- D.Verify that the VPN tunnel is up on both ends
Why B: Even though the VPN tunnel is 'UP', traffic from the VPC to the on-premises network must be routed through the virtual private gateway (VGW). If the VPC route table does not contain a route for the on-premises CIDR (e.g., 192.168.1.0/24) pointing to the VGW, the instances have no path to reach the on-premises server, regardless of tunnel status.
Variation 2. A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?
medium- A.The pre-shared keys are mismatched.
- ✓ B.The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.
- C.The VPN tunnel has been idle for too long and needs to be re-initiated.
- D.The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.
Why B: The most likely cause is that the VPC route tables lack a route pointing to the virtual private gateway (VGW) for the on-premises CIDR. Even though the VPN tunnel is UP (indicating Phase 1 and Phase 2 IPsec SAs are established), traffic from on-premises cannot reach EC2 instances if the VPC does not know how to forward return traffic back through the VGW. Without this route, the VPC drops inbound packets or sends them to the internet gateway instead of the VPN tunnel.
Variation 3. A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?
easy- A.The virtual private gateway is not attached to the customer gateway.
- B.The VPN connection is not associated with a subnet.
- ✓ C.The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.
- D.The security group associated with the VPN endpoint is blocking the traffic.
Why C: The most likely cause is a mismatch in the pre-shared key (PSK) between the customer gateway device and the VPN connection configuration in AWS. IPsec tunnel establishment requires both ends to authenticate using identical PSK values; if they differ, the Internet Key Exchange (IKE) phase 1 negotiation fails, leaving the tunnel status 'DOWN'. This is a common configuration error that directly prevents the VPN from coming up.
Variation 4. Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?
hard- A.The VPN tunnels are not both in UP state
- B.The VPN acceleration is disabled, causing high latency
- C.The VPN connection is configured with static routes only and BGP is not used
- ✓ D.The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway
Why D: The on-premises network can ping the VPC because the VPC route table has a route to 10.0.0.0/16 pointing to the virtual private gateway (VGW), so return traffic from the VPC is correctly forwarded. However, the VPC cannot ping the on-premises network because the on-premises router lacks a route back to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway (CGW). Without this return route, traffic from the VPC reaches the on-premises network, but the on-premises router drops the response packets as it does not know how to reach 172.16.0.0/16.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.