ANS-C01 Static Route VPN Practice Question
A company uses AWS Site-to-Site VPN to connect its on-premises network to a VPC. The VPN connection uses static routes. Recently, the on-premises network administrator added a new subnet (10.0.3.0/24) and needs to ensure that traffic to this subnet is routed through the VPN tunnel. What must be done in the AWS VPC to enable this connectivity?
⚠ Common exam trap
The trap is that candidates might think that enabling route propagation (Option B) works for static route VPNs, but propagation is only supported with BGP. For static routes, you must manually add a static route to the VPC route table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a static route for 10.0.3.0/24 in the VPN connection's route table
For a Site-to-Site VPN connection using static routes, the on-premises network administrator must add a new static route in the VPC route table for the new subnet (10.0.3.0/24), pointing to the virtual private gateway. Option D accomplishes this by adding a static route in the VPN connection's route table. Route propagation (Option B) is only available when the VPN uses BGP dynamic routing, not static routes. Options A and C are incorrect because the customer gateway configuration does not affect VPC routing, and creating a new VPN connection is unnecessary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Update the customer gateway configuration
Why it's wrong here
Incorrect. The customer gateway configuration defines the on-premises VPN device settings and does not affect VPC routing. Updating it would not add the route in AWS.
- ✗
Enable route propagation on the VPN connection
Why it's wrong here
Incorrect. Route propagation is used when the VPN connection uses BGP dynamic routing, not static routes. With static routes, you must manually add the route.
- ✗
Create a new VPN connection for the new subnet
Why it's wrong here
Incorrect. Creating a new VPN connection is unnecessary. You can add the new subnet's route to the existing VPN connection's route table.
- ✓
Add a static route for 10.0.3.0/24 in the VPN connection's route table
Why this is correct
Correct. You need to add a static route for 10.0.3.0/24 in the VPN connection's route table so that traffic to that subnet is routed through the VPN tunnel.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.