ANS-C01 VPC Peering Practice Question
A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?
⚠ Common exam trap
A common trap is assuming that security group statefulness automatically allows all traffic; however, statefulness only applies to return traffic, not initial traffic. Another trap is focusing on NACLs instead of route tables for inter-VPC connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route tables in VPC A point to a VPN gateway instead of the VPC peering connection
For VPC peering to work, each VPC must have routes in their route tables that point to the peering connection as the target for the other VPC's CIDR. If the route table in VPC A points to a VPN gateway instead of the VPC peering connection, traffic will not traverse the peering connection, causing connectivity failure. Option A is incorrect because Network ACLs are stateless and must allow both inbound and outbound ICMP; if they were misconfigured, they could block traffic, but the question states that route tables and security groups are correctly configured, not NACLs. Option C is incorrect because security groups are stateful and automatically allow return traffic; they would not block return traffic. Option D is incorrect because the VPC peering connection being in 'failed' state would prevent connectivity, but the question implies the connection is established (as the engineer verified route tables and security groups, not the peering state).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network ACLs are not configured to allow inbound ICMP
Why it's wrong here
Network ACLs are stateless and must allow both inbound and outbound ICMP. However, the question states the engineer verified route tables and security groups are correct, not NACLs. While misconfigured NACLs could block traffic, the most likely cause given the scenario is a route table issue.
- ✓
The route tables in VPC A point to a VPN gateway instead of the VPC peering connection
Why this is correct
Correct. The route tables in each VPC must have an entry for the other VPC's CIDR with the VPC peering connection as the target. If the route points to a VPN gateway instead, traffic will not use the peering connection.
- ✗
Security groups are stateful and block return traffic
Why it's wrong here
Security groups are stateful; they automatically allow return traffic for inbound connections. They would not block return traffic for ICMP if the inbound rule allows ICMP.
- ✗
The VPC peering connection is in the 'failed' state
Why it's wrong here
If the VPC peering connection were in 'failed' state, it would not work at all. The engineer would likely have noticed that during verification. The question indicates the connection is established, so this is unlikely.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.