ANS-C01 Network Implementation Practice Question
A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. They have a VPC with a CIDR of 10.0.0.0/16 and an on-premises network with CIDR 10.0.0.0/8. The Transit Gateway route table has a static route for 10.0.0.0/8 pointing to the VPN attachment. However, traffic from on-premises to the VPC is not working. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on the TGW route table configuration and overlook the requirement for a return route in the VPC route table, assuming that the TGW handles all routing decisions unilaterally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.
For traffic from on-premises to reach the VPC, the VPC's route table must have a route pointing to the Transit Gateway (TGW) attachment as the target for the on-premises CIDR (10.0.0.0/8). Without this route, the VPC subnet will not forward return traffic to the TGW, causing a one-way communication failure. The TGW route table already has a static route for 10.0.0.0/8 pointing to the VPN attachment, so the issue is on the VPC side, not the TGW.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN attachment is in the wrong TGW route table.
Why it's wrong here
Attachment is associated with the correct route table.
- ✓
The VPC route table does not have a route pointing to the Transit Gateway for on-premises traffic.
Why this is correct
Return traffic needs a route to TGW.
- ✗
The VPC CIDR overlaps with the on-premises CIDR.
Why it's wrong here
Overlap is problematic but not the direct cause here.
- ✗
The Transit Gateway route table does not have a route for the VPC CIDR.
Why it's wrong here
TGW has a route for 10.0.0.0/8, which covers the VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using AWS Transit Gateway to connect multiple VPCs and an on-premises network via AWS Direct Connect. The on-premises network advertises the 10.0.0.0/8 prefix. One VPC has a route to the Transit Gateway for 0.0.0.0/0. Instances in that VPC can reach the internet via a NAT gateway but cannot reach on-premises resources. What is the most likely issue?
medium- A.The security group of the instances does not allow inbound traffic from on-premises
- B.The Direct Connect virtual interface is not associated with the Transit Gateway
- ✓ C.The VPC route table does not have a route to the on-premises CIDR via the Transit Gateway
- D.The on-premises router is not advertising the 10.0.0.0/8 prefix to AWS
Why C: The VPC route table must have a specific route for the on-premises CIDR (10.0.0.0/8) pointing to the Transit Gateway. Without it, traffic destined for on-premises will use the 0.0.0.0/0 default route and go to the NAT gateway instead of the Transit Gateway. Option A is incorrect because the issue is routing, not security groups. Option B is incorrect because the Direct Connect virtual interface must be associated with the Transit Gateway for connectivity, but the question states it is connected, and the problem is likely missing specific routes. Option D is incorrect because the on-premises router is advertising the prefix, but the VPC route table lacks the specific route.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.