ANS-C01 Network Implementation Practice Question
A network engineer is designing a hybrid network architecture that connects an on-premises data center to AWS using AWS Direct Connect and a VPN connection as a backup. The on-premises network uses BGP to advertise routes to AWS. Which of the following are best practices for this setup? (Choose TWO.)
⚠ Common exam trap
Watch out — candidates often think using the same BGP ASN simplifies configuration, but in a dual-connection design, it actually breaks path independence and can cause routing instability or suboptimal failover behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use different BGP ASNs for the Direct Connect and VPN connections.
Using different BGP ASNs for the Direct Connect and VPN connections prevents BGP from treating the two connections as a single eBGP session, which would cause routing loops or suboptimal path selection. This separation allows AWS to distinguish between the two paths and apply independent routing policies. Option E is correct because configuring BGP attributes (such as AS path prepending or MED) on the Direct Connect path ensures it is preferred over the VPN backup, aligning with the design goal of using Direct Connect as the primary link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Advertise the same routes over both connections with identical BGP attributes.
Why it's wrong here
To prefer Direct Connect, different attributes (e.g., AS path prepend) should be used.
- ✓
Use different BGP ASNs for the Direct Connect and VPN connections.
Why this is correct
Different ASNs prevent routing loops and allow proper path selection.
- ✗
Use the VPN connection as the primary path and Direct Connect as the backup.
Why it's wrong here
Direct Connect is typically the primary due to lower latency and higher bandwidth.
- ✗
Use the same BGP ASN for both the Direct Connect and VPN connections.
Why it's wrong here
Using the same ASN can cause BGP issues; best practice is to use different ASNs.
- ✓
Configure BGP attributes to ensure that the Direct Connect path is preferred over the VPN path.
Why this is correct
Adjusting BGP attributes such as local preference or AS path ensures Direct Connect is primary.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.