ANS-C01 Network Design Practice Question
A company uses AWS Direct Connect with a private VIF to connect its on-premises network to a VPC. The on-premises router advertises a specific route for a subnet (192.168.1.0/24) to the VPC via BGP. However, instances in the VPC cannot reach the 192.168.1.0/24 subnet. The VPC route table shows the route as 'active' and 'propagated' from the Direct Connect virtual interface. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC route table does not have a route to the 192.168.1.0/24 subnet pointing to the virtual private gateway.
Even though the VPC route table shows the route as 'active' and 'propagated', this might be the main route table. If the instance's subnet is associated with a different route table that does not have a route to 192.168.1.0/24 pointing to the virtual private gateway, traffic will not be directed properly. The most likely cause is that the subnet's route table lacks this specific route. Option A is incorrect because security groups do not affect outbound traffic initiated by instances, and the issue is routing, not security. Option B is incorrect because overlapping CIDR would cause the route to not appear as active or propagated, contradicting the scenario. Option C is incorrect because BGP communities are not used for route propagation in Direct Connect private VIFs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group for the VPC instances is blocking inbound traffic from the on-premises network.
Why it's wrong here
Security groups do not apply to traffic coming through Direct Connect private VIF; NACLs do.
- ✗
The VPC has overlapping CIDR with the on-premises network.
Why it's wrong here
If overlapping, the route would not show as active.
- ✗
The on-premises router is not advertising the correct BGP community.
Why it's wrong here
BGP community is optional and not required for reachability.
- ✓
The VPC route table does not have a route to the 192.168.1.0/24 subnet pointing to the virtual private gateway.
Why this is correct
Route propagation does not automatically add the route to the route table; it must be associated.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.