ANS-C01 Network Management and Operations Practice Question
A company is using AWS Site-to-Site VPN connections to connect multiple branch offices to a central VPC. The network team wants to ensure high availability and automatic failover if one VPN tunnel goes down. Which configuration should be implemented?
⚠ Common exam trap
A common mix-up: candidates assume a single VPN connection with two tunnels is not enough, and they over-engineer by adding a second VPN connection or using static routes, missing that AWS's built-in dual-tunnel design with BGP already provides automatic failover.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the two tunnels provided by the VPN connection with dynamic routing (BGP)
Each AWS Site-to-Site VPN connection provides two tunnels for high availability. By using dynamic routing (BGP) with both tunnels, the VPN automatically fails over to the second tunnel if the first goes down, without manual intervention. This meets the requirement for automatic failover and high availability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a second VPN connection to the same customer gateway and use BGP with equal-cost multipath
Why it's wrong here
Single VPN connection already has two tunnels; a second connection is not needed.
- ✓
Use the two tunnels provided by the VPN connection with dynamic routing (BGP)
Why this is correct
Two tunnels with BGP provide automatic failover.
- ✗
Use a single tunnel and rely on AWS automatic recovery
Why it's wrong here
Single tunnel is a single point of failure.
- ✗
Configure static routes with a higher metric for the secondary tunnel
Why it's wrong here
Static routes require manual intervention for failover.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.