ANS-C01 Network Management and Operations Practice Question
A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Site-to-Site VPN. The VPN tunnel status shows as UP. The on-premises network can ping the virtual private gateway (VGW) IP address, but cannot reach EC2 instances inside the VPC. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.
The VPC route tables must have a route to the on-premises network pointing to the virtual private gateway (VGW) for traffic to reach the EC2 instances. Without this route, the VPC has no way to send return traffic or allow inbound traffic from on-premises. Option A is incorrect because the VPN tunnel status is UP, indicating the pre-shared key is correct. Option B is plausible but less likely; security groups can block traffic, but they are stateful and automatically allow return traffic. The first step in troubleshooting is to verify routes. Option C is incorrect because the VGW does not have security groups; it uses route tables for forwarding decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN tunnel is not properly configured with the correct pre-shared key.
Why it's wrong here
Tunnel is UP, so pre-shared key is correct.
- ✗
The security groups on the EC2 instances are blocking inbound traffic from the on-premises network.
Why it's wrong here
Security groups are stateful; if outbound is allowed, return traffic is allowed.
- ✗
The virtual private gateway has its own security group that blocks traffic.
Why it's wrong here
VGW does not have security groups.
- ✓
The VPC route tables do not have a route to the on-premises network pointing to the virtual private gateway.
Why this is correct
Without a route back, return traffic is dropped.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.