ANS-C01 Network Management and Operations Practice Question
A multinational corporation is using AWS Transit Gateway to connect multiple VPCs and on-premises networks via AWS Direct Connect and VPN. The network team is experiencing asymmetric routing for traffic between two VPCs that both have routes to the same on-premises network. Which feature should the team implement to resolve this issue?
⚠ Common exam trap
Candidates often confuse AS_PATH prepending with a general routing policy tool, but the key is that it directly influences BGP best-path selection to break ties and enforce path preference, which is exactly what is needed to fix asymmetric routing in a multi-homed Transit Gateway design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AS_PATH prepending on the BGP advertisements from the on-premises router to influence route preference.
AS_PATH prepending allows the on-premises router to artificially lengthen the AS_PATH for specific BGP routes, making those routes less preferred. This influences route selection in the Transit Gateway and VPC route tables, ensuring that traffic from each VPC takes a consistent path and eliminating asymmetric routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a NAT Gateway in each VPC to force symmetric traffic.
Why it's wrong here
NAT Gateways do not control routing between VPCs and on-premises.
- ✓
Use AS_PATH prepending on the BGP advertisements from the on-premises router to influence route preference.
Why this is correct
AS_PATH prepending makes one path less preferred, ensuring symmetric routing.
- ✗
Create a Transit Gateway peering attachment between the two VPCs.
Why it's wrong here
Peering attachments connect Transit Gateways, not VPCs directly, and do not resolve asymmetric routing.
- ✗
Enable VPC Flow Logs to detect and alert on asymmetric flows.
Why it's wrong here
Flow Logs are monitoring tools, not routing controls.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is designing a hybrid network with AWS Direct Connect and a VPN backup. The company has multiple VPCs connected to an AWS Transit Gateway. The on-premises network advertises the same prefixes over both Direct Connect (via private VIF) and VPN (via BGP). The engineer wants to ensure that traffic from the VPCs to on-premises prefers the Direct Connect path. What should the engineer do?
medium- A.Set a higher local preference on the Transit Gateway for Direct Connect routes
- B.Decrease the AS path length on the Direct Connect BGP advertisements
- ✓ C.Configure AS path prepending on the VPN BGP advertisements from on-premises
- D.Set a higher MED on the Direct Connect BGP advertisements
Why C: To prefer the Direct Connect path, the engineer should make the VPN path less preferred in BGP path selection. AS path prepending on the VPN BGP advertisements artificially increases the AS path length, making the VPN route less preferred compared to the Direct Connect route (which has a shorter AS path). Option A is incorrect because local preference is a BGP attribute typically set on the receiving router within an AS, not on the Transit Gateway; the Transit Gateway does not set local preference for routes received from on-premises. Option B is incorrect because you cannot decrease the AS path length below the actual path; the Direct Connect path already has the minimum path length. Option D is incorrect because setting a higher MED (Multi-Exit Discriminator) on the Direct Connect advertisements would make them less preferred (lower MED is better), which is the opposite of what is desired.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.