ANS-C01 Network Security, Compliance and Governance Practice Question
A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN tunnel is up, but traffic from on-premises cannot reach EC2 instances in the VPC. The EC2 instances have a security group that allows inbound ICMP from the on-premises CIDR. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The subnet route table does not have a route for the on-premises CIDR pointing to the virtual private gateway.
For traffic from on-premises to reach EC2 instances in the VPC via Site-to-Site VPN, the subnet route table must include a route for the on-premises CIDR block with the virtual private gateway (VGW) as the target. Option A is incorrect because ICMP is allowed. Option B is incorrect because static routes are not required on the VPN connection itself; routes are needed in the route table. Option D is incorrect because subnet association with the main route table is not necessary; any custom route table works.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group rule is using the wrong protocol.
Why it's wrong here
ICMP is allowed.
- ✗
The VPN connection does not have static routes configured.
Why it's wrong here
Static routes for the on-premises network are configured on the customer gateway.
- ✓
The subnet route table does not have a route for the on-premises CIDR pointing to the virtual private gateway.
Why this is correct
Without this route, traffic from on-premises cannot be routed to the subnet.
- ✗
The subnet is not associated with the main route table.
Why it's wrong here
Association is fine; the route is missing.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a hybrid network with an AWS Site-to-Site VPN connection to an on-premises data center. The network team wants to ensure that only encrypted traffic is sent over the internet between the two sites. The VPC has a virtual private gateway attached. When testing, they discover that some traffic is going over the internet without encryption. Which configuration change should be made to enforce encryption?
hard- ✓ A.Add a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway.
- B.Disable route propagation on the VPC route table to remove any dynamic routes from the VPN.
- C.Enable IPsec acceleration on the VPN tunnel to ensure all traffic is encrypted.
- D.Replace the virtual private gateway with a transit gateway and attach the VPN connection.
Why A: Adding a static route in the VPC route table for the on-premises CIDR block pointing to the virtual private gateway ensures that all traffic destined for the on-premises network is routed through the VPN tunnel, enforcing encryption. Without this static route, traffic might be sent via an internet gateway if a more specific route exists or if route propagation is not properly configured. Option B is incorrect because disabling route propagation would remove dynamic routes from the VPN, but traffic could still go over the internet if there is a route to an internet gateway. Option C is incorrect because IPsec acceleration is about improving performance, not ensuring all traffic uses encryption; the tunnel already uses IPsec. Option D is incorrect because replacing the virtual private gateway with a transit gateway is not necessary; the issue is routing, not the gateway type.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.