ANS-C01 Network Management and Operations Practice Question
A company is using an AWS Transit Gateway to connect multiple VPCs and on-premises networks via Direct Connect. The network team notices that traffic from an on-premises network (CIDR 172.16.0.0/12) to a VPC (CIDR 10.0.0.0/16) is being dropped. The transit gateway route table shows a static route for 10.0.0.0/16 pointing to the VPC attachment. The Direct Connect virtual interface (VIF) is associated with the transit gateway and the on-premises router is advertising 172.16.0.0/12 via BGP. What is the most likely cause of the traffic being dropped?
⚠ Common exam trap
Candidates often assume the transit gateway automatically learns routes from BGP advertisements over Direct Connect and installs them into the route table, but in reality, you must either propagate the attachment or add a static route for the on-premises CIDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The transit gateway route table does not have a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment.
The transit gateway route table must contain a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment for return traffic to be forwarded correctly. Without this route, the transit gateway has no path for traffic destined to the on-premises network, causing it to be dropped. The static route for 10.0.0.0/16 only handles traffic toward the VPC, not the return direction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC has a route that points to the transit gateway for the on-premises CIDR, causing asymmetric routing.
Why it's wrong here
Asymmetric routing can cause issues, but the scenario describes traffic being dropped, not asymmetric routing.
- ✗
The Direct Connect VIF is not configured with BFD.
Why it's wrong here
BFD is for fast failure detection, not for routing traffic; lack of BFD would not cause drops.
- ✓
The transit gateway route table does not have a route for the on-premises CIDR (172.16.0.0/12) pointing to the Direct Connect attachment.
Why this is correct
The transit gateway needs a route for the on-premises CIDR to forward return traffic to the Direct Connect attachment.
- ✗
The VPC route table does not have a route for the on-premises CIDR pointing to the transit gateway.
Why it's wrong here
The VPC route table is for traffic leaving the VPC; the issue is with the transit gateway routing return traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.