The answer is that the on-premises router lacks a route pointing back to the VPC CIDR via the VPN tunnel. Even when the tunnel status shows 'UP', traffic cannot flow bidirectionally unless both sides have reciprocal routing entries; the VPC route table already points to the virtual private gateway for the on-premises CIDR, but the on-premises router must also have a static route directing return traffic for the VPC CIDR into the tunnel interface. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding that a VPN tunnel being 'UP' only confirms Phase 1 and Phase 2 of IPsec are established—it does not guarantee data plane connectivity. A common trap is assuming a misconfigured pre-shared key would still allow the tunnel to show as 'UP', but that would actually prevent the tunnel from establishing at all. Remember the memory tip: "Tunnel UP, traffic stuck? Check the return route—it’s the missing link."
ANS-C01 Network Management and Operations Practice Question
This ANS-C01 practice question tests your understanding of network management and operations. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel status shows 'UP' but traffic is not passing. The engineer checks the route tables and finds that the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely missing configuration?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway
Why wrong: The engineer already checked this route exists.
B
The security group of the EC2 instances does not allow inbound traffic from on-premises
Why wrong: Security groups are stateful and typically allow return traffic; also, the issue is at routing level.
C
The VPN tunnel is using the wrong pre-shared key
Wrong PSK would prevent the tunnel from coming up, but tunnel is UP, so PSK is correct.
D
The on-premises router is not advertising the VPC CIDR over BGP
Why wrong: Advertising routes is for dynamic routing, but static routes can be used; however, the on-premises router must have a route to the VPC CIDR.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPN tunnel is using the wrong pre-shared key
For a VPN to pass traffic, the on-premises router must have a route pointing back to the VPC CIDR via the VPN tunnel. Option B is correct. Options A, C, and D are either already done or not directly related to traffic passing.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway
Why it's wrong here
The engineer already checked this route exists.
✗
The security group of the EC2 instances does not allow inbound traffic from on-premises
Why it's wrong here
Security groups are stateful and typically allow return traffic; also, the issue is at routing level.
✓
The VPN tunnel is using the wrong pre-shared key
Why this is correct
Wrong PSK would prevent the tunnel from coming up, but tunnel is UP, so PSK is correct.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
The on-premises router is not advertising the VPC CIDR over BGP
Why it's wrong here
Advertising routes is for dynamic routing, but static routes can be used; however, the on-premises router must have a route to the VPC CIDR.
Common exam traps
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Network Management and Operations — This question tests Network Management and Operations — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: The VPN tunnel is using the wrong pre-shared key — For a VPN to pass traffic, the on-premises router must have a route pointing back to the VPC CIDR via the VPN tunnel. Option B is correct. Options A, C, and D are either already done or not directly related to traffic passing.
What should I do if I get this ANS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?
easy
A.Verify that the virtual private gateway is attached to the VPC.
✓ B.Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.
C.Verify that the on-premises firewall is not blocking UDP port 500 for IKE.
D.Verify that the VPN tunnel's pre-shared key matches on both sides.
Why B: Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.
Variation 2. A network engineer is diagnosing a connectivity issue between an on-premises network and an Amazon VPC connected via a site-to-site VPN. The VPN tunnel is up, but traffic is not reaching the VPC. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)
medium
✓ A.Review the security group rules associated with the VPC resources to ensure they allow traffic from the on-premises network
B.Confirm the customer gateway is associated with the correct VPC
✓ C.Verify that the VPC route tables include routes for the on-premises network pointing to the virtual private gateway
D.Verify that the on-premises network has a NAT device configured
E.Check that the VPN tunnel's status is 'UP'
Why A: Option A is correct because incorrect route propagation can prevent the VPC from knowing the on-premises network. Option D is correct because security group rules might block inbound traffic from the VPN. Option B is wrong because the VPN tunnel is up. Option C is wrong because the customer gateway is the on-premises endpoint, not the VPC. Option E is wrong because the issue is about routing, not NAT.
Variation 3. A network engineer is troubleshooting a VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA. The tunnel status shows 'UP' but no traffic passes. The engineer checks the route tables and finds the correct static routes on both sides. What should the engineer check next?
hard
✓ A.Review the IPsec phase 2 settings, including the traffic selectors.
B.Check the IKE phase 1 parameters (e.g., encryption, hash).
C.Verify that the pre-shared keys match.
D.Confirm that the VPC route table has a route to the on-premises subnet.
Why A: If the tunnel is up but no traffic passes, the issue is often phase 2 IPsec security associations (SAs) or mismatch in encryption domains. Unlike phase 1, phase 2 can fail silently.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.