ANS-C01 Network Security, Compliance and Governance Practice Question
A network engineer is troubleshooting connectivity issues between an on-premises network and an Amazon VPC over an AWS Direct Connect connection. The on-premises network uses BGP to advertise routes to the VPC. The VPC is associated with a virtual private gateway (VGW). The on-premises network can reach resources in the VPC, but VPC resources cannot reach on-premises resources. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC route tables do not have a route for the on-premises CIDR pointing to the virtual private gateway.
For traffic from the VPC to reach on-premises resources, the VPC route tables must contain a route for the on-premises CIDR block that points to the virtual private gateway (VGW). Since on-premises can reach the VPC, the BGP session is established (so B is incorrect) and the VGW is attached (so A is incorrect). Security groups are stateful and allow return traffic; they do not block outbound-initiated traffic (so C is incorrect).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The virtual private gateway is not attached to the VPC.
Why it's wrong here
If it were not attached, on-premises could not reach VPC either.
- ✗
The BGP session is not established.
Why it's wrong here
If on-premises can reach VPC, BGP must be working.
- ✗
The security group associated with the VPC resources is blocking inbound traffic from on-premises.
Why it's wrong here
Security groups are stateful; if outbound traffic from VPC is allowed, return traffic is automatically allowed.
- ✓
The VPC route tables do not have a route for the on-premises CIDR pointing to the virtual private gateway.
Why this is correct
Without a route, VPC traffic destined for on-premises will not be routed to the Direct Connect.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.