ANS-C01 Network Design Practice Question
A media company is designing a global streaming platform using AWS. They have a primary workload in us-east-1 (VPC A, 10.0.0.0/16) and a secondary workload in eu-west-1 (VPC B, 10.1.0.0/16). They need to replicate data between these VPCs with low latency and high throughput, and also allow their on-premises data center (10.2.0.0/16) in us-east-2 to communicate with both VPCs. The on-premises network is connected to AWS via two Direct Connect connections terminating in us-east-1 and eu-west-1. The company uses a Transit Gateway in each region, with inter-region peering between the Transit Gateways. The on-premises network has BGP advertisements for 10.2.0.0/16. The routing is set up such that the on-premises network can reach both VPCs via the Direct Connect connections. However, the VPCs cannot reach each other's CIDRs. The network engineer checks the Transit Gateway route tables and sees that the inter-region peering attachment is associated with the appropriate route tables, and static routes for the remote VPC CIDRs are present. What is the MOST likely cause of the problem?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The static routes for the remote VPC CIDRs are pointing to the Direct Connect attachment instead of the inter-region peering attachment
In a Transit Gateway inter-region peering, you need to add static routes in both directions to point to the peering attachment. The engineer confirmed static routes are present, so that might not be the issue. However, a common misconfiguration is that the on-premises network's route propagation via Direct Connect may be causing the Transit Gateway to prefer the on-premises path (which may not have connectivity between regions) over the inter-region peering. But the VPCs cannot reach each other's CIDRs, so the issue is likely that the route tables for the VPC attachments do not have the routes for the remote VPC CIDRs pointing to the inter-region peering attachment. Alternatively, the inter-region peering attachment might not be in the correct route table. The most likely issue is that the Transit Gateway route tables for the VPCs do not include routes for the remote VPC CIDRs via the peering attachment. Since the engineer says they are present, the issue might be that the propagation from the Direct Connect attachment is overriding the static route with a less preferred route or causing a conflict. Actually, the most common problem is that the static routes for the inter-region CIDRs are pointing to the wrong attachment (e.g., the Direct Connect attachment instead of the peering attachment).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The inter-region peering attachment is not in the same route table as the VPC attachments
Why it's wrong here
It should be associated with the route table that contains the VPC attachments, but the engineer checked.
- ✗
The VPC CIDRs overlap with each other
Why it's wrong here
The VPC CIDRs are 10.0.0.0/16 and 10.1.0.0/16, which do not overlap; overlapping CIDRs would prevent route propagation in the Transit Gateway route tables, but here static routes for remote VPCs are already present, so the issue lies elsewhere. This option is tempting because overlapping CIDRs are a common cause of inter-VPC routing failures, and in a scenario where both VPCs used the same IP range, overlapping addresses would indeed block connectivity and require NAT or re-addressing.
- ✓
The static routes for the remote VPC CIDRs are pointing to the Direct Connect attachment instead of the inter-region peering attachment
Why this is correct
This would cause traffic to be sent to on-premises, which cannot route between regions, causing blackhole.
- ✗
The on-premises network is advertising a default route that is being preferred
Why it's wrong here
Default route would affect internet bound traffic, not specific VPC CIDRs.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.