ANS-C01 Network Implementation Practice Question
A network engineer is troubleshooting a connectivity issue between two VPCs (VPC-A and VPC-B) that are connected via a VPC peering connection. The engineer has verified that the route tables in both VPCs have the appropriate routes. However, instances in VPC-A cannot ping instances in VPC-B. Which TWO actions should the engineer take to resolve this issue? (Choose two.)
⚠ Common exam trap
AWS often tests the distinction between stateless network ACLs and stateful security groups, and candidates mistakenly assume that correct route tables alone guarantee connectivity, overlooking the need to verify both firewall layers for the specific protocol (ICMP).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the network ACLs in VPC-B allow inbound ICMP traffic from VPC-A.
Network ACLs are stateless firewalls that control inbound and outbound traffic at the subnet level. Even if the route tables are correctly configured, a network ACL in VPC-B that denies inbound ICMP traffic from VPC-A's CIDR will block ping requests. Option D is correct because security groups are stateful and must explicitly allow inbound ICMP traffic from VPC-A's CIDR; without this rule, the instances in VPC-B will drop the ping requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a route in VPC-A's route table pointing to the VPC peering connection for the CIDR of VPC-B.
Why it's wrong here
The stem says route tables already have appropriate routes, so this is already in place.
- ✗
Enable DNS resolution for the VPC peering connection.
Why it's wrong here
DNS resolution is not required for ICMP ping; it is for hostname resolution.
- ✓
Verify that the network ACLs in VPC-B allow inbound ICMP traffic from VPC-A.
Why this is correct
Network ACLs are stateless and must allow both inbound and outbound traffic; if ICMP is denied, pings will fail.
- ✓
Verify that the security groups of the instances in VPC-B allow inbound ICMP traffic from the CIDR of VPC-A.
Why this is correct
Security groups are stateful but default to deny inbound traffic; if ICMP is not allowed, pings will fail.
- ✗
Configure a transit gateway to route traffic between the two VPCs.
Why it's wrong here
VPC peering is direct; a transit gateway is not required and would change the architecture.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.