The answer is that the VPC subnet route tables lack a route for the on-premises CIDR pointing to the virtual private gateway. Even when the AWS VPN tunnel is up and BGP sessions are established, traffic from the on-premises network cannot reach EC2 instances unless the VPC subnets explicitly know how to route return traffic back to the on-premises CIDR via the VGW. This is a classic "tunnel up, no traffic" scenario that tests your understanding of how route propagation and static routes interact in a Site-to-Site VPN setup. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this concept frequently appears as a distractor where candidates assume BGP automatically handles all routing, but BGP only exchanges routes between the CGW and VGW—it does not automatically add routes to the VPC subnet route tables unless you enable route propagation or add them manually. A common trap is checking security groups or the CGW configuration first, but the real issue is almost always missing subnet routes. Memory tip: "Tunnel up, BGP green, but no ping? Check the subnet route table—it’s the missing link."
ANS-C01 Network Implementation Practice Question
This ANS-C01 practice question tests your understanding of network implementation. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is setting up an AWS Site-to-Site VPN connection between its on-premises network and a VPC. The VPC has a virtual private gateway (VGW) attached, and the VPN connection uses two tunnels for redundancy. The on-premises customer gateway (CGW) is configured with the public IP address of the on-premises VPN device. The VPN tunnels are up and BGP sessions are established. However, the company cannot ping an EC2 instance in the VPC from an on-premises server. The security group for the EC2 instance allows ICMP from the on-premises network CIDR. What is the MOST likely cause of the issue?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.
Option A is correct because the VPC subnet route tables must have a route pointing to the VGW for the on-premises CIDR. Option B is incorrect because BGP is established. Option C is incorrect because the CGW is configured correctly. Option D is incorrect because the VPN connection does not have a security group.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway.
Why this is correct
Without a route, traffic from VPC to on-premises is dropped.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
The BGP session is not advertising the on-premises routes to the VGW.
Why it's wrong here
Stem says BGP is established, so routes should be advertised.
Common exam traps
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Network Implementation — This question tests Network Implementation — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: The route tables of the VPC subnets do not have a route for the on-premises CIDR pointing to the virtual private gateway. — Option A is correct because the VPC subnet route tables must have a route pointing to the VGW for the on-premises CIDR. Option B is incorrect because BGP is established. Option C is incorrect because the CGW is configured correctly. Option D is incorrect because the VPN connection does not have a security group.
What should I do if I get this ANS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an AWS Site-to-Site VPN connection between their on-premises network and a VPC. The VPN tunnel status shows 'UP'. However, instances in the VPC cannot ping an on-premises server at 192.168.1.10. Which step should be taken to troubleshoot?
easy
A.Verify that the internet gateway is attached to the VPC
✓ B.Verify that the VPC route table has a route to the on-premises network via the virtual private gateway
C.Verify that the security group for the instances allows outbound ICMP
D.Verify that the VPN tunnel is up on both ends
Why B: Option B is correct because the VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway (or transit gateway). Option A is wrong because the tunnel is up. Option C is wrong because security groups are stateful and usually allow outbound ping. Option D is wrong because the VPN connection uses the virtual private gateway, not the internet gateway.
Variation 2. A company has set up a site-to-site VPN connection between its on-premises network and AWS. The tunnel status shows 'UP' on both sides, but traffic from on-premises cannot reach EC2 instances in the VPC. What is the most likely cause?
medium
A.The pre-shared keys are mismatched.
✓ B.The VPC route tables do not have a route pointing to the virtual private gateway for the on-premises CIDR.
C.The VPN tunnel has been idle for too long and needs to be re-initiated.
D.The security group associated with the EC2 instances does not allow inbound traffic from the VPN gateway.
Why B: The correct answer is C because the tunnel being up indicates Layer 3 connectivity, but traffic may be blocked by VPC route tables or security group rules. Option A is incorrect because tunnel status is up. Option B is incorrect because a mismatch in pre-shared keys would prevent the tunnel from establishing. Option D is incorrect because the VPN gateway is the target, not a route table entry.
Variation 3. A network engineer is setting up a site-to-site VPN connection between an on-premises network and an AWS VPC. The engineer configures the customer gateway device with the correct parameters. However, the VPN tunnel status remains 'DOWN'. What is the most likely cause?
easy
A.The virtual private gateway is not attached to the customer gateway.
B.The VPN connection is not associated with a subnet.
✓ C.The pre-shared key on the customer gateway device does not match the pre-shared key configured in the VPN connection.
D.The security group associated with the VPN endpoint is blocking the traffic.
Why C: Option B is correct because the VPN tunnel pre-shared keys (PSK) must match exactly between the customer gateway and the AWS VPN endpoint. Option A is wrong because security groups do not affect VPN tunnel establishment; they control traffic within the VPC. Option C is wrong because the virtual private gateway (VGW) is attached to the VPC, not the customer gateway. Option D is wrong because the VPN connection must be associated with the VGW, not a subnet.
Variation 4. Refer to the exhibit. A VPN connection is established between an on-premises network (10.0.0.0/16) and an AWS VPC (172.16.0.0/16). The on-premises network can ping the VPC's private IP addresses, but the VPC cannot ping the on-premises network's IP addresses. The VPC route table has a route to 10.0.0.0/16 pointing to the VGW. What is the MOST likely cause?
hard
A.The VPN tunnels are not both in UP state
B.The VPN acceleration is disabled, causing high latency
C.The VPN connection is configured with static routes only and BGP is not used
✓ D.The on-premises network does not have a route to the VPC CIDR (172.16.0.0/16) pointing to the customer gateway
Why D: Option B is correct because the VPN connection has a static route for 10.0.0.0/16, but the remote network CIDR is 0.0.0.0/0, which may cause routing issues. However, the main issue is that the VPC has a route to 10.0.0.0/16, but the on-premises network may not have a route back to the VPC's CIDR (172.16.0.0/16). Option A is incorrect because the tunnels are up. Option C is incorrect because static routes are configured. Option D is incorrect because acceleration is optional.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.