ANS-C01 Network Implementation Practice Question
A company is using AWS Client VPN to provide remote access to their VPC. Users report that they can connect to the VPN but cannot reach resources in the VPC. Which THREE configuration items should the engineer verify?
⚠ Common exam trap
The ANS-C01 exam often tests the distinction between authentication (certificate validity) and authorization (network access rules), leading candidates to incorrectly select certificate issues when the problem is actually about routing or security group rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The authorization rules allow access to the VPC's CIDR.
Authorization rules in AWS Client VPN define which networks (CIDRs) users are allowed to access. If the rule does not include the VPC's CIDR, traffic to resources in the VPC will be dropped even though the VPN tunnel is established. This is a common misconfiguration that prevents resource reachability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The authorization rules allow access to the VPC's CIDR.
Why this is correct
Authorization rules define which networks users can access.
- ✓
The Client VPN endpoint is associated with the correct subnets.
Why this is correct
Subnet association determines which subnets are reachable via the VPN.
- ✗
The Client VPN endpoint has a public IP address.
Why it's wrong here
The endpoint is accessed via a DNS name, and the public IP is managed by AWS.
- ✓
The security groups attached to the target resources allow traffic from the VPN CIDR.
Why this is correct
Security groups must allow inbound traffic from the VPN's client CIDR.
- ✗
The client certificate is issued by a valid CA.
Why it's wrong here
Authentication is separate from network access; if users can connect, the certificate is valid.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.