ANS-C01 Network Design Practice Question
A company uses AWS Direct Connect with a private VIF and a virtual private gateway (VGW) to connect its on-premises data center to a VPC. The on-premises network uses BGP to advertise routes to AWS. The VPC has multiple subnets. The company wants to ensure that only traffic destined for the VPC CIDR (10.0.0.0/16) is sent over Direct Connect, and all other traffic uses the internet. However, after configuration, on-premises users can access the internet through the Direct Connect link, which is unintended. What change should be made to restrict traffic?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.
The issue arises because AWS is advertising a default route (0.0.0.0/0) to the on-premises router over BGP via Direct Connect, causing on-premises users to use Direct Connect for internet traffic. To restrict traffic, the on-premises router should be configured to accept only the VPC CIDR (10.0.0.0/16) from AWS and reject any default route. Option C is correct. Option A is incorrect because adding a static route in the VPC route table does not affect BGP advertisements to on-premises. Option B is incorrect because disabling route propagation affects VPC subnet routing, not the BGP session. Option D is incorrect because removing the virtual private gateway would disconnect the VPC, not solve the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a static route in the VPC route table to send all traffic to the internet gateway.
Why it's wrong here
This does not affect on-premises routing.
- ✗
Disable route propagation for the private subnet route table.
Why it's wrong here
Route propagation affects VPC routing, not on-premises.
- ✓
Configure the on-premises router to only accept the VPC CIDR route from AWS and not a default route.
Why this is correct
This prevents the on-premises network from using Direct Connect for internet traffic.
- ✗
Remove the virtual private gateway and use a VPN connection instead.
Why it's wrong here
This would break the Direct Connect connection.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.