ANS-C01 Network Design Practice Question
A company uses AWS Direct Connect to connect its on-premises network to a VPC. They have a private VIF attached to a virtual private gateway. They want to use AWS Site-to-Site VPN as a backup connection. Which configuration ensures automatic failover?
⚠ Common exam trap
AWS often tests the misconception that static routes can provide automatic failover, but static routes lack dynamic withdrawal, so BGP must be used on both connections with AS path prepending to ensure automatic and predictable failover.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use BGP on both the Direct Connect private VIF and the VPN connection, and advertise the same prefixes with a longer AS path for the VPN.
Using BGP on both the Direct Connect private VIF and the VPN connection allows you to manipulate route selection via AS path prepending. By advertising the same prefixes with a longer AS path on the VPN, the Direct Connect path is preferred, and if it fails, BGP withdraws the routes, causing traffic to automatically fail over to the VPN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach the VPN connection to a separate virtual private gateway and use a transit gateway to combine them.
Why it's wrong here
Attaching the VPN to a separate virtual private gateway (VPG) and combining them with a Transit Gateway prevents automatic failover for a single VPC. A Transit Gateway routes traffic based on the longest prefix match and performs equal-cost multi-path (ECMP) routing for identical routes, rather than prioritising one path for failover. This configuration is tempting because Transit Gateway centralises network connectivity, making it suitable for connecting multiple VPCs to on-premises networks or consolidating various Direct Connect and VPN connections across an organisation.
- ✗
Use static routes on the Direct Connect private VIF and BGP on the VPN connection.
Why it's wrong here
Static routes do not fail over automatically.
- ✓
Use BGP on both the Direct Connect private VIF and the VPN connection, and advertise the same prefixes with a longer AS path for the VPN.
Why this is correct
This provides automatic failover via BGP.
- ✗
Create a second Direct Connect connection and use equal-cost multipath (ECMP) between the two.
Why it's wrong here
This does not provide a backup; both are primary.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.