ANS-C01 Network Management and Operations Practice Question
A company is using AWS Client VPN to provide remote access to employees. Users report that they can connect to the VPN but cannot reach resources in the VPC. The Client VPN endpoint is associated with a subnet, and authorization rules are configured. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Client VPN endpoint's security group does not allow inbound traffic from the client IP pool.
The most likely cause is that the Client VPN endpoint's security group does not allow inbound traffic from the client IP pool. Since users can connect to the VPN, the subnet association and authorization rules are correctly configured. However, the security group attached to the VPN endpoint acts as a virtual firewall for inbound and outbound traffic. If it does not permit inbound traffic from the client IP range, resources in the VPC will not be reachable. The network ACLs are stateless and default to allowing outbound traffic, so they are less likely to be the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Client VPN endpoint's security group does not allow inbound traffic from the client IP pool.
Why this is correct
The security group acts as a firewall for the VPN endpoint; if it doesn't allow traffic from the client CIDR, traffic is blocked.
- ✗
The VPC's network ACLs are blocking traffic.
Why it's wrong here
Network ACLs affect subnet traffic, but the VPN endpoint security group is more immediate.
- ✗
The authorization rules are not associated with the correct groups.
Why it's wrong here
Authorization rules control access to specific networks; if misconfigured, they could block, but the most likely cause is security group.
- ✗
The subnet association is missing.
Why it's wrong here
The question states the endpoint is associated with a subnet.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Client VPN to provide remote access to its VPC resources. Users report that they can connect to the VPN but cannot reach any resources in the VPC. The VPN endpoint is associated with a subnet in VPC A. The VPC's route table has a route for the Client VPN CIDR (10.200.0.0/16) pointing to the VPN endpoint. The security group assigned to the VPN endpoint allows inbound traffic from the VPN clients. What is the most likely cause of the issue?
medium- A.The Client VPN endpoint's authentication is failing.
- B.The VPN endpoint is not associated with the correct subnet.
- C.The route table in VPC A does not have a route for the Client VPN CIDR.
- ✓ D.The security group associated with the VPN endpoint does not allow inbound traffic from the VPN client CIDR.
Why D: The most likely cause is that the security group associated with the VPN endpoint does not have an inbound rule that permits traffic from the entire Client VPN CIDR range (10.200.0.0/16). Although the stem states that the security group allows inbound traffic from 'the VPN clients', this wording is ambiguous. If the rule only allows traffic from specific client IP addresses (which may change or not cover all VPN clients), then packets from clients within the CIDR range will be dropped before they can be routed to VPC resources. The VPN connection itself may succeed because the security group rule for the VPN tunnel's control traffic is separate. For data traffic to reach resources, the security group must explicitly allow the full client CIDR.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.