Monitoring BGP Status for VPN Tunnels
A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via VPN. The network team needs to monitor the BGP session status for each VPN attachment. Which TWO services can be used to monitor BGP status and receive alerts if a session goes down?
Quick Answer
The answer is Amazon CloudWatch metrics for VPN tunnels and CloudWatch Alarms. CloudWatch provides built-in VPN tunnel metrics, including the BGP session status as a 0 or 1 value, allowing you to monitor BGP status for VPN attachments in real time. By creating a CloudWatch Alarm on this metric, you can receive alerts immediately if a session goes down, which is essential for maintaining hybrid connectivity. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this question tests your understanding of which AWS services provide operational visibility into network layer protocols—a common trap is confusing VPC Flow Logs (which capture IP traffic metadata) or AWS Config (which tracks resource configuration) with real-time protocol monitoring. Remember that BGP is a control-plane protocol, so only CloudWatch’s tunnel-level metrics expose its state. Memory tip: think “BGP = Border Gateway Protocol, but also ‘Be Good with Pulse’—CloudWatch gives you the pulse of the BGP session.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Alarms on the BGP status metric.
Amazon CloudWatch provides metrics for VPN tunnels, including the BGP status metric (e.g., TunnelState, BGPStatus). CloudWatch Alarms can be set on this metric to trigger notifications if the BGP session goes down. Option A is correct because CloudWatch Alarms on the BGP status metric directly monitor and alert on BGP session state. Option E is correct because CloudWatch metrics for VPN tunnels include BGP status data. Option B (AWS Config) is incorrect because AWS Config is used for resource compliance and configuration changes, not real-time monitoring of BGP sessions. Option C (VPC Flow Logs) is incorrect because VPC Flow Logs capture IP traffic information, not BGP routing protocol status. Option D (AWS CloudTrail) is incorrect because CloudTrail logs API calls, not BGP session state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Amazon CloudWatch Alarms on the BGP status metric.
Why this is correct
Alarms can notify when BGP goes down.
- ✗
AWS Config rules.
Why it's wrong here
Config tracks configuration, not operational status.
- ✗
VPC Flow Logs.
Why it's wrong here
Flow Logs capture IP traffic, not BGP.
- ✗
AWS CloudTrail logs.
Why it's wrong here
CloudTrail logs API calls, not BGP.
- ✓
Amazon CloudWatch metrics for VPN tunnels.
Why this is correct
CloudWatch provides BGP status metrics.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with a VPN connection to an on-premises network. The network team reports that the VPN tunnel is flapping intermittently. You need to identify the cause. Which AWS service provides logs that can help troubleshoot the VPN tunnel status?
hard- A.VPC Flow Logs
- ✓ B.Amazon CloudWatch
- C.AWS CloudTrail
- D.AWS Health Dashboard
Why B: Amazon CloudWatch provides VPN tunnel metrics, including tunnel state, data in/out, and other status indicators that help identify the cause of flapping. Option A (VPC Flow Logs) captures IP traffic but not tunnel status. Option C (AWS CloudTrail) logs API calls, not tunnel status. Option D (AWS Health Dashboard) shows service health events but not detailed tunnel status.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.