The answer is that the route table associated with the EC2 instance’s subnet does not have a route for the on-premises CIDR. While the VPC’s main route table may correctly point 10.0.0.0/8 to the virtual private gateway, the EC2 instance resides in a subnet that uses a custom route table—and if that custom table lacks a route for the on-premises range, the instance will attempt to send return traffic via the local route, which cannot reach 10.0.0.5. This causes the ping to fail because the reply never enters the VPN tunnel. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of subnet route table inheritance and the common pitfall of assuming the main route table applies to all subnets. A frequent trap is overlooking that each subnet must explicitly have a route for the remote network, even when the VPC-level route exists. Memory tip: “Subnets are picky—they only follow their own route table, not the VPC’s main one.”
ANS-C01 Network Implementation Practice Question
This ANS-C01 practice question tests your understanding of network implementation. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network engineer is troubleshooting connectivity issues from an on-premises data center to an Amazon VPC via an AWS Site-to-Site VPN. The VPN tunnel is up, but ping from an on-premises host (10.0.0.5) to an EC2 instance (172.16.1.10) fails. The VPC CIDR is 172.16.0.0/16. The on-premises CIDR is 10.0.0.0/8. The customer gateway device has a route for 172.16.0.0/16 pointing to the VPN tunnel. The VPC route table has a route for 10.0.0.0/8 pointing to the virtual private gateway. Security groups and NACLs allow ICMP. What is the MOST likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR
Option D is correct because by default, an EC2 instance in a VPC does not send traffic destined for the VPC's own CIDR range to the virtual private gateway; it uses local routing. The on-premises ping source IP is 10.0.0.5, which is within the VPC CIDR (172.16.0.0/16) range? Actually 10.0.0.5 is not within VPC CIDR, but the issue is that the EC2 instance's response to 10.0.0.5 will be sent via the local route (since 10.0.0.0/8 is not local but the VPC has a route for it) – wait: The VPC has a route for 10.0.0.0/8 to the virtual private gateway, so the EC2 instance should send traffic to the VGW. But the ping might be failing due to asymmetric routing if the on-premises side does not have a route for the return traffic? No, the on-premises has a route. Actually, the most common issue is that the EC2 instance does not have the correct route in its subnet route table for the return traffic? But the route table has the route. Another common issue is that the virtual private gateway does not propagate routes to the subnet route table? But the route is there. Wait: The correct answer is that the on-premises host's return traffic might be dropped due to the VPN tunnel not having the correct source/destination check? No. Let me re-evaluate: The VPC route table has a route for 10.0.0.0/8 to the virtual private gateway. That is correct. The on-premises has a route for 172.16.0.0/16 to the VPN tunnel. So traffic should flow. However, by default, EC2 instances have source/destination check enabled. If the EC2 instance is used as a NAT instance or similar, it might need to be disabled. But here it's a simple ping. The most likely cause is that the on-premises network does not have a route for the VPC CIDR pointing to the customer gateway? But it does. Actually, the issue might be that the customer gateway device's route is not pointing to the correct interface. Another possibility: The VPN tunnel uses dynamic routing (BGP) and the routes are not being advertised correctly. But the question does not specify BGP. Given the options, the correct answer is likely D: The route table does not have a route for the on-premises CIDR. Wait, the VPC route table does have a route for 10.0.0.0/8. So that's not it. Let me think again: The ping from 10.0.0.5 to 172.16.1.10: The packet goes from on-prem to VPC via VPN. The EC2 instance receives it. The EC2 instance sends a reply to 10.0.0.5. The EC2 instance checks its route table: the VPC route table has a route for 10.0.0.0/8 to the virtual private gateway. So it sends the reply to the VGW. The VGW forwards it to the VPN tunnel. That should work. But why does it fail? Possibly because the subnet route table for the EC2 instance does not have the route for 10.0.0.0/8? The question says the VPC route table has the route, but the subnet route table might be different. Actually, each subnet route table can be different. The question says 'The VPC route table has a route for 10.0.0.0/8 pointing to the virtual private gateway.' That implies the main route table. But the EC2 instance might be in a subnet with a custom route table that does not have that route. So the most likely cause is that the route is missing from the subnet route table associated with the EC2 instance's subnet. Option D says 'The route table associated with the EC2 instance's subnet does not have a route for on-premises traffic.' That is exactly it. So D is correct.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The on-premises host does not have a route to the VPC CIDR
Why it's wrong here
Incorrect; the on-premises host has a route for 172.16.0.0/16 pointing to the VPN tunnel.
✗
The customer gateway device is not configured with the correct pre-shared key
Why it's wrong here
Incorrect; if the tunnel is up, the pre-shared key is correct.
✓
The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR
Why this is correct
Correct; the subnet route table must include a route for the on-premises CIDR pointing to the virtual private gateway.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
The virtual private gateway is not attached to the correct VPC
Why it's wrong here
Incorrect; the VPC route table has a route to the VGW, so it is attached.
Common exam traps
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Network Implementation — This question tests Network Implementation — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: The route table associated with the EC2 instance's subnet does not have a route for the on-premises CIDR — Option D is correct because by default, an EC2 instance in a VPC does not send traffic destined for the VPC's own CIDR range to the virtual private gateway; it uses local routing. The on-premises ping source IP is 10.0.0.5, which is within the VPC CIDR (172.16.0.0/16) range? Actually 10.0.0.5 is not within VPC CIDR, but the issue is that the EC2 instance's response to 10.0.0.5 will be sent via the local route (since 10.0.0.0/8 is not local but the VPC has a route for it) – wait: The VPC has a route for 10.0.0.0/8 to the virtual private gateway, so the EC2 instance should send traffic to the VGW. But the ping might be failing due to asymmetric routing if the on-premises side does not have a route for the return traffic? No, the on-premises has a route. Actually, the most common issue is that the EC2 instance does not have the correct route in its subnet route table for the return traffic? But the route table has the route. Another common issue is that the virtual private gateway does not propagate routes to the subnet route table? But the route is there. Wait: The correct answer is that the on-premises host's return traffic might be dropped due to the VPN tunnel not having the correct source/destination check? No. Let me re-evaluate: The VPC route table has a route for 10.0.0.0/8 to the virtual private gateway. That is correct. The on-premises has a route for 172.16.0.0/16 to the VPN tunnel. So traffic should flow. However, by default, EC2 instances have source/destination check enabled. If the EC2 instance is used as a NAT instance or similar, it might need to be disabled. But here it's a simple ping. The most likely cause is that the on-premises network does not have a route for the VPC CIDR pointing to the customer gateway? But it does. Actually, the issue might be that the customer gateway device's route is not pointing to the correct interface. Another possibility: The VPN tunnel uses dynamic routing (BGP) and the routes are not being advertised correctly. But the question does not specify BGP. Given the options, the correct answer is likely D: The route table does not have a route for the on-premises CIDR. Wait, the VPC route table does have a route for 10.0.0.0/8. So that's not it. Let me think again: The ping from 10.0.0.5 to 172.16.1.10: The packet goes from on-prem to VPC via VPN. The EC2 instance receives it. The EC2 instance sends a reply to 10.0.0.5. The EC2 instance checks its route table: the VPC route table has a route for 10.0.0.0/8 to the virtual private gateway. So it sends the reply to the VGW. The VGW forwards it to the VPN tunnel. That should work. But why does it fail? Possibly because the subnet route table for the EC2 instance does not have the route for 10.0.0.0/8? The question says the VPC route table has the route, but the subnet route table might be different. Actually, each subnet route table can be different. The question says 'The VPC route table has a route for 10.0.0.0/8 pointing to the virtual private gateway.' That implies the main route table. But the EC2 instance might be in a subnet with a custom route table that does not have that route. So the most likely cause is that the route is missing from the subnet route table associated with the EC2 instance's subnet. Option D says 'The route table associated with the EC2 instance's subnet does not have a route for on-premises traffic.' That is exactly it. So D is correct.
What should I do if I get this ANS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting connectivity from an on-premises network to an EC2 instance in a VPC via a Site-to-Site VPN. The VPN tunnel is up, but the engineer cannot ping the EC2 instance's private IP. What should the engineer check first?
easy
A.The VPN connection status in the AWS console.
B.Security group inbound rules for ICMP on the EC2 instance.
C.IKE version mismatch between the VPN endpoints.
✓ D.Route propagation and route tables in the VPC and on-premises.
Why D: Option A is correct because the route tables on the on-premises router and in the VPC must have routes for the remote networks. Option B is incorrect because the VPN tunnel being up indicates Phase 1 and 2 are likely fine. Option C is incorrect because security groups are stateful and allow ICMP if outbound is allowed. Option D is incorrect because the VPN connection is active.
Last reviewed: Jun 20, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.