ANS-C01 Network Implementation Practice Question
A network engineer is troubleshooting connectivity issues from an on-premises data center to an Amazon VPC via an AWS Site-to-Site VPN. The VPN tunnel is up, but ping from an on-premises host (10.0.0.5) to an EC2 instance (172.16.1.10) fails. The VPC CIDR is 172.16.0.0/16. The on-premises CIDR is 10.0.0.0/8. The customer gateway device has a route for 172.16.0.0/16 pointing to the VPN tunnel. The VPC route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. Security groups and NACLs allow ICMP. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR
The most likely cause is that the subnet route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR (10.0.0.0/8). Although the VPC's main route table has a route for 10.0.0.0/8 pointing to the virtual private gateway, the EC2 instance's subnet may be using a custom route table that lacks this route. Without it, the EC2 instance's return ICMP traffic to 10.0.0.5 is sent via the local route (which only covers the VPC CIDR 172.16.0.0/16) and does not reach the VPN tunnel, causing the ping to fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The on-premises host does not have a route to the VPC CIDR
Why it's wrong here
Incorrect; the on-premises host has a route for 172.16.0.0/16 pointing to the VPN tunnel.
- ✗
The customer gateway device is not configured with the correct pre-shared key
Why it's wrong here
A mismatched pre-shared key would prevent the VPN tunnel from establishing at all, yet the stem states the tunnel is up, so authentication is already successful. This option is tempting because pre-shared key errors are a common cause of VPN failures, but they occur during Phase 1 negotiation, not after the tunnel is operational.
- ✓
The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR
Why this is correct
Correct; the subnet route table must include a route for the on-premises CIDR pointing to the virtual private gateway.
- ✗
The virtual private gateway is not attached to the correct VPC
Why it's wrong here
Incorrect; the VPC route table has a route to the VGW, so it is attached.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?
easy- A.The VPN connection status in the AWS console.
- B.Security group inbound rules for ICMP on the EC2 instance.
- C.IKE version mismatch between the VPN endpoints.
- ✓ D.Route propagation and route tables in the VPC and on-premises.
Why D: The VPN tunnel being up indicates the IPsec/IKE negotiation succeeded, but reachability to the EC2 instance requires proper routing. The most common cause of ping failure when the tunnel is up is missing or incorrect route propagation from the VPN to the VPC route tables, or missing static routes on the on-premises side pointing to the VPN gateway. Without correct routes, traffic from the on-premises network cannot reach the VPC subnets, and return traffic from the EC2 instance cannot reach the on-premises network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.