ANS-C01 Network Management and Operations Practice Question
Network Topology
A network engineer is troubleshooting an EC2 instance that cannot connect to S3 via a VPC endpoint. The describe-vpc-endpoints output shows the endpoint is associated with a route table but no subnets. What is the likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The subnet's route table does not include a route for the S3 prefix list via the endpoint.
The VPC endpoint for S3 is a Gateway Endpoint, which is associated with a route table, not a subnet. For the EC2 instance to connect to S3 via the endpoint, the route table associated with the instance's subnet must include a route that directs traffic to the S3 prefix list through the endpoint. If the endpoint is associated with a route table that is different from the subnet's route table, or if the subnet's route table lacks the route, traffic will not use the endpoint. Therefore, the likely issue is that the subnet's route table does not contain the required route for the S3 prefix list via the endpoint. Option A is incorrect because DNS resolution is not the primary issue; the endpoint DNS names should resolve. Option B is incorrect because the endpoint policy defaults to allow all, and there is no indication of a deny. Option C is incorrect because the endpoint state is available as per the output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS entry for the endpoint is not resolving.
Why it's wrong here
DNS entry exists.
- ✗
The VPC endpoint policy denies access to S3.
Why it's wrong here
Policy allows all.
- ✗
The VPC endpoint state is not available.
Why it's wrong here
The state is available.
- ✓
The subnet's route table does not include a route for the S3 prefix list via the endpoint.
Why this is correct
Gateway Endpoints rely on route table entries; the subnet must have the route.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.