ANS-C01 Network Management and Operations Practice Question
A network engineer is troubleshooting a VPN connection that is not passing traffic. The tunnel status shows as 'UP'. Which THREE steps should the engineer take to diagnose the issue?
⚠ Common exam trap
Test-takers frequently assume a 'UP' tunnel guarantees traffic flow, but AWS often tests that Layer 3 routing and security group rules are separate from tunnel status and must be verified independently.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that the security groups for instances allow inbound traffic from the on-premises network
Security groups act as a virtual firewall for instances, controlling inbound and outbound traffic at the instance level. Even if the VPN tunnel is up, traffic will be dropped if the security group does not explicitly allow inbound traffic from the on-premises network's IP range. This is a common misconfiguration that prevents traffic flow despite a healthy tunnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure that the security groups for instances allow inbound traffic from the on-premises network
Why this is correct
Security groups can block traffic even if the VPN is up.
- ✓
Confirm that the on-premises router is advertising the correct routes via BGP
Why this is correct
BGP must advertise routes to the VPC for traffic to return.
- ✗
Check the IKE and IPSEC settings on the customer gateway
Why it's wrong here
Tunnel is UP, so IKE/IPSEC settings are likely correct.
- ✓
Verify that the VPC route table has a route to the on-premises network via the virtual private gateway
Why this is correct
Without a route, traffic won't be sent to the VPN.
- ✗
Check the internet gateway route table for the VPC
Why it's wrong here
Internet gateway is not used for VPN traffic.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting a VPN connectivity issue. The VPN tunnel is up, but traffic is not passing. Which TWO AWS services should the engineer use to diagnose the problem?
medium- A.AWS Config
- ✓ B.VPC Flow Logs
- C.AWS CloudTrail
- D.AWS Direct Connect
- ✓ E.Amazon CloudWatch
Why B: The correct answers are B and E. VPC Flow Logs capture IP traffic information for network interfaces, which can show if traffic is reaching the VPN endpoint. Amazon CloudWatch provides VPN tunnel metrics (e.g., tunnel state, data in/out) and logs, helping to diagnose connectivity issues. Option A (AWS Config) is incorrect because it tracks resource configuration changes, not network traffic. Option C (AWS CloudTrail) is incorrect because it logs API calls, not data plane traffic. Option D (AWS Direct Connect) is incorrect because it is a dedicated connection service, not a diagnostic tool for VPN.
Variation 2. A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?
easy- A.The VPN tunnel is not properly configured with the correct pre-shared key.
- B.The security groups on the EC2 instances are blocking inbound traffic from the on-premises network.
- C.The virtual private gateway has its own security group that blocks traffic.
- ✓ D.The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.
Why D: The VPC route tables must have a route to the on-premises network pointing to the virtual private gateway (VGW) for traffic to reach the EC2 instances. Without this route, the VPC has no way to send return traffic or allow inbound traffic from on-premises. Option A is incorrect because the VPN tunnel status is UP, indicating the pre-shared key is correct. Option B is plausible but less likely; security groups can block traffic, but they are stateful and automatically allow return traffic. The first step in troubleshooting is to verify routes. Option C is incorrect because the VGW does not have security groups; it uses route tables for forwarding decisions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.