ANS-C01 Network Management and Operations Practice Question
A network engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a public subnet and an on-premises server over AWS Direct Connect. The instance can reach the internet but cannot reach the on-premises server. Which TWO actions should the engineer take to diagnose the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the VPC route table to ensure a route exists for the on-premises CIDR pointing to the virtual private gateway
The correct answers are A and C. For connectivity between an EC2 instance in a public subnet and an on-premises server over AWS Direct Connect, two key checks are: (1) The VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway (VGW) to route traffic to the Direct Connect connection. (2) The security group attached to the EC2 instance must allow inbound traffic from the on-premises CIDR, as security groups act as a stateful firewall for the instance. Option B is incorrect because Direct Connect uses a virtual private gateway, not a VPN tunnel. Option D is incorrect because VPC Flow Logs are used for analysis, not real-time diagnosis. Option E is incorrect because network ACLs are stateless; outbound traffic does not automatically allow return traffic, so explicit inbound rules are required for the return traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the VPC route table to ensure a route exists for the on-premises CIDR pointing to the virtual private gateway
Why this is correct
Correct. The VPC route table must have a route for the on-premises CIDR pointing to the virtual private gateway to route traffic over Direct Connect.
- ✗
Check the VPN connection status to ensure the tunnel is up
Why it's wrong here
Incorrect. Direct Connect uses a virtual private gateway, not a VPN tunnel.
- ✓
Check the security group attached to the EC2 instance to ensure it allows inbound traffic from the on-premises CIDR
Why this is correct
Correct. The security group must allow inbound traffic from the on-premises CIDR.
- ✗
Enable VPC Flow Logs and analyze them for dropped packets
Why it's wrong here
Incorrect. VPC Flow Logs are used for post-event analysis, not real-time diagnosis.
- ✗
Check the network ACLs for the subnet to ensure they allow inbound traffic from on-premises
Why it's wrong here
Incorrect. Network ACLs are stateless and require explicit inbound rules for on-premises traffic; they do not automatically allow return traffic. While a misconfigured NACL could cause the issue, the security group is the more common culprit for instance-level filtering.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.