ANS-C01 Network Management and Operations Practice Question
A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The network team notices that VPC A cannot communicate with VPC B, while all other VPCs communicate normally. The transit gateway route table shows routes from both VPCs. Which TWO actions should the network engineer take to diagnose the issue? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the security groups and network ACLs in VPC A and VPC B.
Security groups and network ACLs in the VPCs can block traffic even if Transit Gateway routes are correct. Option D is correct because the VPCs must be associated with the correct Transit Gateway route table; an incorrect association can prevent communication. Option B is wrong because a VPN connection is not required for VPC-to-VPC communication via Transit Gateway. Option C is wrong because VPC peering is not necessary when using Transit Gateway; the issue is likely a configuration problem within the Transit Gateway setup. Option E is wrong because AWS Direct Connect is unrelated to inter-VPC routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the security groups and network ACLs in VPC A and VPC B.
Why this is correct
Correct: Security group or NACL rules may be blocking traffic between the VPCs.
- ✗
Establish a VPN connection between VPC A and the transit gateway.
Why it's wrong here
Incorrect: VPCs are attached to the transit gateway; VPN is not needed for VPC-to-VPC.
- ✗
Create a VPC peering connection between VPC A and VPC B.
Why it's wrong here
Incorrect: VPC peering is unnecessary with Transit Gateway.
- ✓
Verify that the VPCs are associated with the correct transit gateway route table.
Why this is correct
Correct: Without proper route table association, the VPCs won't use the transit gateway's routes.
- ✗
Configure an AWS Direct Connect virtual interface between the VPCs.
Why it's wrong here
Incorrect: Direct Connect is for on-premises connectivity, not inter-VPC.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.