ANS-C01 Network Management and Operations Practice Question
A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?
⚠ Common exam trap
Test-takers frequently assume a 'tunnel up' status guarantees traffic flow, but the ANS-C01 exam tests the distinction between control plane (tunnel establishment) and data plane (routing) issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.
Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the virtual private gateway is attached to the VPC.
Why it's wrong here
It is already attached as stated.
- ✓
Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.
Why this is correct
Without a return route, traffic from on-premises may not reach the VPC.
- ✗
Verify that the on-premises firewall is not blocking UDP port 500 for IKE.
Why it's wrong here
If the tunnel is up, IKE is working.
- ✗
Verify that the VPN tunnel's pre-shared key matches on both sides.
Why it's wrong here
If the tunnel is up, the pre-shared key is correct.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.