ANS-C01 BGP AS Path Prepend Practice Question
A company runs a critical application on EC2 instances in an Auto Scaling group across two Availability Zones in a VPC. The application communicates with an on-premises database over an AWS Direct Connect private VIF. The network team has configured a VPN connection as a backup. Recently, the application experienced intermittent timeouts when accessing the database. The team suspects asymmetric routing because the primary Direct Connect and backup VPN are both active. The network team wants to ensure that all traffic to the on-premises network uses the Direct Connect when it is available, and only fails over to the VPN if Direct Connect goes down. The BGP sessions are configured on both connections. The Direct Connect advertises the on-premises CIDR of 10.0.0.0/16, and the VPN advertises the same CIDR. The team has access to the on-premises router configuration and AWS console. Which action should the team take to resolve the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the on-premises router to prepend one or more AS numbers to the routes advertised over the VPN BGP session.
AS path prepending on the VPN BGP session makes the VPN path less preferred by BGP (longer AS path). Since the Direct Connect path has a shorter AS path, BGP will select the Direct Connect path for all traffic to the on-premises CIDR, ensuring symmetric routing. Option A is incorrect because static routes do not provide dynamic failover and can cause routing issues. Option C is incorrect because advertising a more specific prefix over VPN would make the VPN path more specific (longest prefix match), causing traffic to prefer the VPN, exacerbating the problem. Option D is incorrect because disabling BGP on the VPN removes dynamic routing and reduces redundancy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a static route in the VPC route table pointing to the Direct Connect virtual interface for the on-premises CIDR.
Why it's wrong here
Adding a static route would not dynamically failover and could cause issues if Direct Connect fails.
- ✓
Configure the on-premises router to prepend one or more AS numbers to the routes advertised over the VPN BGP session.
Why this is correct
AS path prepending on the VPN makes the VPN path less preferred, so Direct Connect is used when available.
- ✗
Advertise a more specific prefix (e.g., 10.0.0.0/24) over the VPN BGP session to attract traffic.
Why it's wrong here
Advertising a more specific prefix over VPN would make the VPN path more specific (longest prefix match), so traffic would prefer VPN, causing the same problem.
- ✗
Disable BGP on the VPN connection and use static routes instead.
Why it's wrong here
Disabling BGP on the VPN removes dynamic routing, causing potential routing issues and reducing redundancy.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.