ANS-C01 Network Management and Operations Practice Question
A network engineer is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. The VPCs are in the same region. After accepting the peering request, instances in VPC-A cannot communicate with instances in VPC-B. What should the engineer check first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route tables in both VPCs have routes to the peer VPC CIDR.
For VPC peering to work, each VPC's route table must have a route to the peer VPC's CIDR block pointing to the peering connection. Without these routes, traffic will not be directed across the peering link. Option A is incorrect because security groups are stateful and can allow traffic, but they are not the first check; the routing issue is more fundamental. Option B is incorrect because network ACLs are stateless and could block traffic, but again, routing is the primary concern. Option D is incorrect because while the VPC peering connection status should be 'active' for traffic to flow, the most common issue after accepting the request is missing route table entries; thus, checking route tables should be the first step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security groups in both VPCs allow traffic from the peer VPC CIDR.
Why it's wrong here
Security groups can be configured to allow cross-account traffic, but they are not the first check.
- ✗
The network ACLs in both VPCs allow traffic from the peer VPC CIDR.
Why it's wrong here
Network ACLs are stateless and must allow inbound/outbound traffic from the peer VPC CIDR. However, without proper route tables, traffic won't even reach the NACLs. The first check should be routing.
- ✓
The route tables in both VPCs have routes to the peer VPC CIDR.
Why this is correct
Route tables must be updated with routes to the peer VPC CIDR. Without these routes, traffic is not directed to the peering connection.
- ✗
The VPC peering connection status is 'active'.
Why it's wrong here
The VPC peering connection status must be 'active' for communication. However, the question states the peering request was accepted, so it is likely active. The first check should be route tables.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.