ANS-C01 Network Implementation Practice Question
A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?
⚠ Common exam trap
It's easy for candidates to assume a UP tunnel guarantees connectivity, but the tunnel state only confirms Layer 3 encryption is established, not that routing or security group rules allow traffic to flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Route propagation and route tables in the VPC and on-premises.
The VPN tunnel being up indicates the IPsec/IKE negotiation succeeded, but reachability to the EC2 instance requires proper routing. The most common cause of ping failure when the tunnel is up is missing or incorrect route propagation from the VPN to the VPC route tables, or missing static routes on the on-premises side pointing to the VPN gateway. Without correct routes, traffic from the on-premises network cannot reach the VPC subnets, and return traffic from the EC2 instance cannot reach the on-premises network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN connection status in the AWS console.
Why it's wrong here
Tunnel up indicates connection is active.
- ✗
Security group inbound rules for ICMP on the EC2 instance.
Why it's wrong here
Security groups are stateful; outbound ICMP may be blocked but inbound is needed for ping reply.
- ✗
IKE version mismatch between the VPN endpoints.
Why it's wrong here
Tunnel up means IKE is working.
- ✓
Route propagation and route tables in the VPC and on-premises.
Why this is correct
Missing routes are a common cause.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.