ANS-C01 Network Implementation Practice Question
Network Topology
A network engineer examines the route table above. The VPC has a CIDR of 10.0.0.0/16. There is a VPC peering connection (pcx-...) to a VPC with CIDR 192.168.0.0/16. However, instances in this route table's subnet cannot communicate with the peered VPC. What is the most likely cause?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a missing route is the only cause for VPC peering communication failure, but the trap here is that the route is present, so candidates must consider security group or network ACL filtering as the next most likely cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group or network ACL in the source subnet is blocking traffic.
The route table shown includes a route for the peered VPC (192.168.0.0/16 via pcx-...), and the route table is associated with the subnet (implied by the question stating 'this route table's subnet'). Since routing is in place, the most likely remaining cause is that a security group (stateful, blocking inbound/outbound traffic) or a network ACL (stateless, blocking inbound/outbound traffic) is filtering the traffic between the subnets. Security groups and network ACLs operate at the instance and subnet level respectively, and misconfigured rules can prevent communication even when routes are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The route table is not associated with the subnet.
Why it's wrong here
The subnet uses this route table, as implied.
- ✗
The VPC peering connection is in 'pending-acceptance' state.
Why it's wrong here
The command does not show the state, but likely it is active if the route exists.
- ✓
The security group or network ACL in the source subnet is blocking traffic.
Why this is correct
Even with correct routing, security groups/NACLs can block traffic.
- ✗
The route to the peered VPC is missing from the route table.
Why it's wrong here
The route is present.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.