ANS-C01 Network Implementation Practice Question
A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises the 10.0.0.0/8 prefix. One VPC has a route to the Transit Gateway for 0.0.0.0/0. Instances in that VPC can reach the internet via a NAT gateway but cannot reach on-premises resources. What is the most likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC route table does not have a route to the on-premises CIDR via the Transit Gateway
The VPC route table must have a specific route for the on-premises CIDR (10.0.0.0/8) pointing to the Transit Gateway. Without it, traffic destined for on-premises will use the 0.0.0.0/0 default route and go to the NAT gateway instead of the Transit Gateway. Option A is incorrect because the issue is routing, not security groups. Option B is incorrect because the Direct Connect virtual interface must be associated with the Transit Gateway for connectivity, but the question states it is connected, and the problem is likely missing specific routes. Option D is incorrect because the on-premises router is advertising the prefix, but the VPC route table lacks the specific route.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group of the instances does not allow inbound traffic from on-premises
Why it's wrong here
Security groups can block but routing is the more likely issue.
- ✗
The Direct Connect virtual interface is not associated with the Transit Gateway
Why it's wrong here
Association may be correct, but route propagation is missing.
- ✓
The VPC route table does not have a route to the on-premises CIDR via the Transit Gateway
Why this is correct
A specific route for 10.0.0.0/8 via Transit Gateway must exist.
- ✗
The on-premises router is not advertising the 10.0.0.0/8 prefix to AWS
Why it's wrong here
On-premises advertises the prefix; the issue is in the VPC route table.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.