ANS-C01 Network Management and Operations Practice Question
A network engineer is troubleshooting intermittent connectivity issues between an EC2 instance in a private subnet and an RDS database in another VPC connected via a VPC peering connection. The connection works for a few minutes and then drops. CloudWatch logs show no errors on the peering connection. What should the engineer check first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route tables in both VPCs to ensure they have routes pointing to the peering connection for the respective CIDR blocks.
Intermittent connectivity over a VPC peering connection is often caused by missing or incorrect route table entries. Traffic must be able to return from the RDS database VPC to the EC2 instance VPC, so both VPCs need routes pointing to the peering connection for the respective CIDR blocks. Option A is incorrect because DNS resolution settings affect name resolution, not connectivity drops. Option B is incorrect because network ACLs are stateless and would cause consistent blocking, not intermittent drops. Option C is incorrect because security groups are stateful and allow return traffic automatically; they would not cause intermittent issues once allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS resolution settings of the VPC peering connection.
Why it's wrong here
DNS resolution affects hostname resolution, not connectivity drops once connection is established.
- ✗
The network ACL of the subnet where the EC2 instance resides.
Why it's wrong here
NACLs are stateless but would block consistently if rules are missing, not intermittently.
- ✗
The security group attached to the RDS database allowing traffic from the EC2 instance.
Why it's wrong here
Security groups are stateful and allow return traffic, so they would not cause intermittent drops.
- ✓
The route tables in both VPCs to ensure they have routes pointing to the peering connection for the respective CIDR blocks.
Why this is correct
Missing or incorrect routes can cause asymmetric routing and drops.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting intermittent connectivity issues between two VPCs that are peered. The VPC peering connection is in the 'active' state. ICMP ping from an instance in VPC A to an instance in VPC B fails intermittently. What is the most likely cause?
easy- A.The network ACLs are blocking ICMP traffic.
- B.The security groups on the instances do not allow inbound ICMP.
- C.The VPC peering connection is not in the 'active' state.
- ✓ D.The route tables in one or both VPCs lack routes to the peer VPC's CIDR via the peering connection.
Why D: Since the VPC peering connection is active, the issue is likely that the route tables in one or both VPCs are not correctly configured to route traffic to the peered VPC's CIDR via the peering connection. Without proper routes, traffic is dropped.
Variation 2. A network engineer is troubleshooting connectivity between two VPCs that are peered. The VPC peering connection is active, and the route tables have appropriate routes. However, instances in VPC A cannot reach instances in VPC B. The security groups in both VPCs allow all traffic. What is the most likely issue?
medium- A.The security groups are not allowing ICMP traffic
- ✓ B.The route tables in both VPCs do not have routes pointing to the peering connection for the other VPC's CIDR
- C.The VPC peering connection is not in the 'active' state
- D.The instances are in different availability zones
Why B: The most likely issue is that the route tables in both VPCs do not have routes pointing to the VPC peering connection for the other VPC's CIDR. Although the VPC peering connection is active, without explicit routes in the route tables, traffic cannot be directed to the peer VPC. Since security groups allow all traffic, they are not the cause. Different availability zones do not affect VPC peering. Therefore, the correct answer is B.
Variation 3. A network engineer is troubleshooting connectivity issues between two VPCs that are peered. The VPCs are in the same region but different accounts. The engineer verifies that the route tables and security group rules are correctly configured. However, instances in VPC A cannot ping instances in VPC B. What is the most likely cause?
hard- A.Network ACLs are not configured to allow inbound ICMP
- ✓ B.The route tables in VPC A point to a VPN gateway instead of the VPC peering connection
- C.Security groups are stateful and block return traffic
- D.The VPC peering connection is in the 'failed' state
Why B: For VPC peering to work, each VPC must have routes in their route tables that point to the peering connection as the target for the other VPC's CIDR. If the route table in VPC A points to a VPN gateway instead of the VPC peering connection, traffic will not traverse the peering connection, causing connectivity failure. Option A is incorrect because Network ACLs are stateless and must allow both inbound and outbound ICMP; if they were misconfigured, they could block traffic, but the question states that route tables and security groups are correctly configured, not NACLs. Option C is incorrect because security groups are stateful and automatically allow return traffic; they would not block return traffic. Option D is incorrect because the VPC peering connection being in 'failed' state would prevent connectivity, but the question implies the connection is established (as the engineer verified route tables and security groups, not the peering state).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.