ANS-C01 Network Management and Operations Practice Question
A network engineer is diagnosing a connectivity issue between two VPCs connected via VPC peering. The engineer has confirmed that the route tables in both VPCs have appropriate routes and the security groups allow traffic. However, traffic from VPC A to VPC B fails. Which TWO steps should the engineer take to troubleshoot? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the network ACL of the subnet in VPC B where the target instance resides.
Checking the network ACL (NACL) of the subnet in VPC B where the target instance resides can reveal if inbound traffic is blocked by the stateless NACL. Option D is correct because verifying the operating system firewall on the target instance in VPC B can block traffic even if AWS network rules are open. Option B is wrong because VPC peering can work across different AWS accounts, so being in the same account is not necessary. Option C is wrong because the engineer should already have verified the peering connection status as part of initial checks; if it were inactive, the problem would be obvious, so it is not a likely next step. Option E is wrong because while VPC Flow Logs are useful for deep analysis, they are not the first step for a basic connectivity check; direct checks like NACLs and OS firewalls are more immediate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the network ACL of the subnet in VPC B where the target instance resides.
Why this is correct
NACLs are stateless and may block inbound traffic.
- ✗
Confirm that both VPCs are in the same AWS account.
Why it's wrong here
Cross-account VPC peering works; this is not a typical issue.
- ✗
Verify the VPC peering connection status is active.
Why it's wrong here
Assuming route tables are correct, the peering status is likely active, so this is not a priority.
- ✓
Check the operating system firewall on the target instance.
Why this is correct
Instance-level firewall can block traffic.
- ✗
Enable VPC Flow Logs on both VPCs to analyze traffic.
Why it's wrong here
Flow Logs are helpful but not the first step; basic checks should be done first.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. The VPCs are in the same region. After accepting the peering request, instances in VPC-A cannot communicate with instances in VPC-B. What should the engineer check first?
medium- A.The security groups in both VPCs allow traffic from the peer VPC CIDR.
- B.The network ACLs in both VPCs allow traffic from the peer VPC CIDR.
- ✓ C.The route tables in both VPCs have routes to the peer VPC CIDR.
- D.The VPC peering connection status is 'active'.
Why C: For VPC peering to work, each VPC's route table must have a route to the peer VPC's CIDR block pointing to the peering connection. Without these routes, traffic will not be directed across the peering link. Option A is incorrect because security groups are stateful and can allow traffic, but they are not the first check; the routing issue is more fundamental. Option B is incorrect because network ACLs are stateless and could block traffic, but again, routing is the primary concern. Option D is incorrect because while the VPC peering connection status should be 'active' for traffic to flow, the most common issue after accepting the request is missing route table entries; thus, checking route tables should be the first step.
Variation 2. Refer to the exhibit. A network engineer has established a VPC peering connection between VPC A (10.0.0.0/16) in account 111111111111 and VPC B (192.168.0.0/16) in account 222222222222. The peering connection status is 'active'. However, instances in VPC A cannot reach instances in VPC B. What is the MOST likely cause?
medium- A.The peering connection is not in the 'active' state
- ✓ B.Route tables in one or both VPCs do not have routes to the peer CIDR
- C.Security groups in VPC B are blocking traffic
- D.The CIDR blocks overlap
Why B: The VPC peering connection is active, so A is incorrect. The CIDR blocks (10.0.0.0/16 and 192.168.0.0/16) do not overlap, so D is incorrect. Security groups can block traffic, but the most common cause is missing routes in the route tables of one or both VPCs to the peer CIDR via the peering connection. Therefore, B is correct.
Variation 3. A network engineer is setting up a VPC peering connection between two VPCs in the same AWS account and Region. Which TWO steps are required to enable communication between instances in the peered VPCs? (Choose two.)
easy- A.Attach an internet gateway to each VPC
- B.Establish a VPN connection between the VPCs
- ✓ C.Add routes in each VPC's route table pointing to the CIDR of the other VPC
- D.Configure a NAT gateway in each VPC
- ✓ E.Update security group rules to allow traffic from the peered VPC CIDR
Why C: VPC peering requires adding routes in both VPC route tables to direct traffic to the peered VPC's CIDR. Option E is correct because security group rules must be updated to allow inbound traffic from the peered VPC's CIDR. Option A is incorrect because VPC peering does not require an internet gateway. Option B is incorrect because VPC peering does not use a VPN connection. Option D is incorrect because a NAT gateway is not required for VPC peering.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.