ANS-C01 Network Management and Operations Practice Question
A company is using a transit gateway to connect multiple VPCs and on-premises networks via VPN. The network team notices that some VPCs can communicate with each other but not with the on-premises network. The transit gateway route tables are configured correctly. Which TWO configurations should the team check?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the on-premises router is advertising the on-premises CIDR over BGP to the VPN
Options C and E are correct. For VPCs to communicate with the on-premises network, the on-premises router must advertise its CIDR over BGP (C) so the transit gateway learns the route. Additionally, the VPN attachment must be associated with the correct transit gateway route table (E) to propagate the learned routes and enable connectivity. Option A is incorrect because the transit gateway is available if inter-VPC traffic works. Option B is incorrect because security groups are instance-level and do not affect routing; if inter-VPC traffic works, security groups are not the issue. Option D is incorrect because VPC Flow Logs only log traffic, they do not affect routing or configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the transit gateway is in a 'available' state
Why it's wrong here
Transit gateway is likely available since some traffic works.
- ✗
Check the security group rules of the EC2 instances in the VPCs
Why it's wrong here
Security groups would affect inter-VPC traffic as well, which works.
- ✓
Verify that the on-premises router is advertising the on-premises CIDR over BGP to the VPN
Why this is correct
If routes are not advertised, the transit gateway won't have paths to on-premises.
- ✗
Check the VPC Flow Logs for dropped packets
Why it's wrong here
Flow Logs don't affect routing.
- ✓
Confirm that the VPN attachment is associated with the correct transit gateway route table
Why this is correct
If the VPN attachment is not associated with a route table that has routes to on-premises, traffic won't flow.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.