ANS-C01 Network Management and Operations Practice Question
A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection uses a private virtual interface (VIF) and BGP. The network team recently added a new CIDR block (10.0.3.0/24) to the VPC. They updated the VPC's route table to include a route to the on-premises network. However, the on-premises network cannot reach resources in the new subnet. The BGP session is up, and the Direct Connect gateway is configured. What should the network team do to resolve the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the new CIDR block (10.0.3.0/24) to the Direct Connect gateway's allowed prefixes.
When a new CIDR block is added to an existing VPC connected via Direct Connect, the Direct Connect gateway must be updated to include the new prefix in its allowed prefixes list. By default, the Direct Connect gateway only advertises prefixes that are explicitly allowed. The on-premises network cannot reach the new subnet because the gateway is not advertising the 10.0.3.0/24 route via BGP. Option C is correct: add the new CIDR to the Direct Connect gateway's allowed prefixes. Option A is incorrect because adding a static route on the on-premises router does not affect BGP advertisements from the AWS side; the gateway must advertise the route. Option B is unnecessary and adds complexity; the issue is with prefix propagation, not with connectivity. Option D is incorrect because a new private VIF is not needed; the existing VIF can handle multiple prefixes if allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a static route in the on-premises router pointing to the Direct Connect interface.
Why it's wrong here
Static route would work but does not address the BGP advertisement. The issue is the missing prefix in allowed prefixes.
- ✗
Set up a new VPN connection as a backup and route traffic over VPN.
Why it's wrong here
Not necessary; the Direct Connect connection is functional, just missing prefix advertisement.
- ✓
Add the new CIDR block (10.0.3.0/24) to the Direct Connect gateway's allowed prefixes.
Why this is correct
This allows the Direct Connect gateway to advertise the new prefix to the on-premises network via BGP.
- ✗
Create a new private VIF for the new CIDR block.
Why it's wrong here
A single private VIF can handle multiple CIDRs; no need for a new VIF.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.